网络服务发现

Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.^[1]

APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.^[2]

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.^[3][4]

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.^[5]

Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.^[6]

BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.^[7]

BADHATCH can check for open ports on a computer by establishing a TCP connection.^[8]

BlackEnergy has conducted port scans on a host.^[9]

BlackTech has used the SNScan tool to find other potential targets on victim networks.^[10]

Brute Ratel C4 can conduct port scanning against targeted systems.^[11]

During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.^[12]

During C0027, used RustScan to scan for open ports on targeted ESXi appliances.^[13]

Caterpillar WebShell has a module to use a port scanner on a system.^[14]

Chimera has used the get -b -e -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.^[15]

China Chopper's server component can spider authentication portals.^[16]

Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.^[17][18][19]

Cobalt Strike can perform port scans from an infected host.^[20][21][22]

Conficker scans for other machines to infect.^[23]

During CostaRicto, the threat actors employed nmap and pscan to scan target environments.^[24]

DarkVishnya performed port scanning to obtain the list of active services.^[25]

Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.^[26]

Empire can perform port scans from an infected host.^[27]

FIN13 has utilized nmap for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.^[28][29]

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.^[30]

Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.^[31][32]

As part of load balancing FRP can set healthCheck.type = "tcp" or healthCheck.type = "http" to check service status on specific hosts with TCPing or an HTTP request.^[33]

HDoor scans to identify open ports on the victim.^[34]

HermeticWizard has the ability to scan ports on a compromised network.^[35]

Hildegard has used masscan to look for kubelets in the internal Kubernetes network.^[36]

During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.^[37][38]

INC Ransom has used NETSCAN.EXE for internal reconnaissance.^[39][40]

Industroyer uses a custom port scanner to map out a network.^[41]

InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.^[42]

Koadic can scan for open TCP ports on the target network.^[43]

Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.^[44]

Leafminer scanned network services to search for vulnerabilities in the victim system.^[45]

Lucifer can scan for open ports including TCP ports 135 and 1433.^[46]

Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.^[47]

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.^[48]

MgBot includes modules for performing HTTP and server service scans.^[49]

MURKYTOP has the capability to scan for open ports on hosts in a connected network.^[16]

Naikon has used the LadonGo scanner to scan target networks.^[50]

NBTscan can be used to scan IP networks.^[51][52]

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.^[53]

During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.^[54]

P.A.S. Webshell can scan networks for open ports and listening services.^[55]

Peirates can initiate a port scan against a given IP address.^[56]

PoshC2 can perform port scans from an infected host.^[57]

Pupy has a built-in module for port scanning.^[58]

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.^[59]

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.^[60][61]

RedCurl has used netstat to check if port 4119 is open.^[62]

Remsec has a plugin that can perform ARP scanning as well as port scanning.^[63]

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.^[64][65]

Royal can scan the network interfaces of targeted systems.^[66]

SILENTTRINITY can scan for open ports on a compromised machine.^[67]

SpeakUp checks for availability of specific ports on servers.^[68]

Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.^[69]

TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.^[70][36][71] TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.^[72]

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.^[73][74]

Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.^[75][76]

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.^[77]

Xbash can perform port scanning of TCP and UDP ports.^[78]

XTunnel is capable of probing the network for open ports.^[79]

ZxShell can launch port scans.^[5][80]

Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.

Use network intrusion detection/prevention systems to detect and prevent remote service scans.

Ensure proper network segmentation is followed to protect critical servers and devices.