T1046Discovery
Network Service Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system. Within cloud environments, adversaries may attempt to discover…
CVEs8
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.8
Reports1
Detections
20 Sigma rules tagged T1046Network Service DiscoveryT104620 general rules
- HackTool - winPEAS Executionhightest
- HackTool - WinPwn Executionhightest
- HackTool - WinPwn Execution - ScriptBlockhightest
- Grixba Malware Reconnaissance Activityhighexperimental
- OpenCanary - Host Port Scan (SYN Scan)highexperimental
- OpenCanary - NMAP FIN Scanhighexperimental
- OpenCanary - NMAP NULL Scanhighexperimental
- OpenCanary - NMAP OS Scanhighexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Network Service Discovery
8 CVEs, by priority. Each link shows its badge.- CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.0T1595Active ScanningT1190Exploit Public-Facing Application+4 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%85.4priority
- CVE-2023-38035Ivanti Sentry Authentication Bypass VulnerabilityIvanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+6 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.03%79.9priority
- CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityFortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1133External Remote Services+5 moreMITRE CTID mapping of the KEV entry · follow-on activity30.9%Top 1.7%79.5priority
- CVE-2019-13608Citrix StoreFront Server XML External Entity (XXE) Processing VulnerabilityCitrix · StoreFront ServerKEVRansomwarePublic exploitHigh · 7.5T1078Valid AccountsT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · follow-on activity30.0%Top 1.8%77.9priority
- CVE-2019-11634Citrix Workspace Application and Receiver for Windows Remote Code Execution VulnerabilityCitrix · Workspace Application and Receiver for WindowsKEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+5 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity8.1%Top 5.2%77.7priority
- CVE-2023-26360Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityAdobe · ColdFusionKEVPublic exploitHigh · 8.6T1190Exploit Public-Facing ApplicationT1059.007JavaScript+7 moreMITRE CTID mapping of the KEV entry · follow-on activity97.3%Top 0.1%69.0priority
- CVE-2021-21973VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) VulnerabilityVMware · vCenter Server and Cloud FoundationKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing ApplicationT1046Network Service DiscoveryMITRE CTID mapping of the KEV entry · primary impact88.0%Top 0.24%66.7priority
- CVE-2021-39935GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityGitLab · Community and Enterprise EditionsKEVHigh · 7.5T1190Exploit Public-Facing ApplicationT1046Network Service DiscoveryAI mapping from the description · primary impact36.1%Top 1.5%62.9priority