Adversaries may perform network connection enumeration to discover information about device communication patterns. If an adversary can inspect the state of a network connection with tools, such as Netstat[1], in conjunction with System Firmware, then they can determine the role of certain devices on the network [2]. The adversary can also use Network Sniffing to watch network traffic for details about the source, destination, protocol, and content.
| ID | Name | Description |
|---|---|---|
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries used |
| S0605 | EKANS |
EKANS performs a DNS lookup of an internal domain name associated with its target network to identify if it was deployed on the intended system. [4] |
| S0604 | Industroyer |
Industroyer contains an IEC 61850 module that enumerates all connected network adapters to determine their TCP/IP subnet masks. [5] |
| ID | Mitigation | Description |
|---|---|---|
| M0816 | Mitigation Limited or Not Effective |
Network connection enumeration is likely obtained by using common system tools (e.g., netstat, ipconfig). |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0770 | Detection of Network Connection Enumeration | AN1902 |
Real-time monitoring identifies execution of network enumeration commands (netstat, arp -a, Get-NetTCPConnection) on an Industrial Control System (ICS) host from an account not associated with documented network administration, where multiple such commands execute in sequence within a short window. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
| AN2142 |
Real-time monitoring identifies execution of network enumeration tools (ss, netstat, arp, ip neigh) on an Industrial Control System (ICS) Linux asset from a User Identifier (UID) that does not normally perform network administration. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2184 |
Real-time monitoring identifies Simple Network Management Protocol (SNMP) walk requests, Cisco Discovery Protocol (CDP)/Link Layer Discovery Protocol (LLDP) enumeration frames, or Internet Control Message Protocol (ICMP)-based traceroute sequences from an Industrial Control System (ICS) host that has not previously generated management-protocol traffic. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2232 |
Real-time monitoring identifies Industrial Control System (ICS) protocol messages querying network topology information from embedded devices -- neighbor device lists, Common Industrial Protocol (CIP) port object information -- from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |