| ID | Name |
|---|---|
| T0846.001 | Port Scan |
| T0846.002 | Broadcast Discovery |
| T0846.003 | Multicast Discovery |
Adversaries may perform a port scan on a system, device, or network to identify live hosts, enumerate open ports and running services, identify operating systems, and map out the network.[1] The results of a port scan may inform adversary Discovery, Lateral Movement, and vulnerability exploitation decisions (Exploitation for Evasion, Exploitation for Privilege Escalation, Exploitation of Remote Services).
Some common tools for executing a port scan include nmap, netcat, and the Advanced Port Scanner.
| ID | Name | Description |
|---|---|---|
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries used Advanced Port Scanner and Advanced IP Scanner to conduct remote system discovery activities.[2] |
| S1045 | INCONTROLLER |
INCONTROLLER has the ability to perform scans for TCP port 4840 to identify devices running OPC UA servers.[3] |
| S0604 | Industroyer |
The Industroyer IEC 61850 payload component has the ability to discover relevant devices in the infected host's network subnet by attempting to connect on port 102.[4] |
| S9046 | IOControl |
IOCONTROL has conducted port scans on a network.[5] |
| S1006 | PLC-Blaster |
PLC-Blaster scans the network to find other Siemens S7 PLC devices to infect. It locates these devices by checking for a service listening on TCP port 102.[6] |
| ID | Mitigation | Description |
|---|---|---|
| M0931 | Network Intrusion Prevention |
Use network intrusion detection/prevention systems to detect and prevent port scans. |
| M0930 | Network Segmentation |
Ensure proper network segmentation is followed to protect critical systems and devices. |
| M0814 | Static Network Configuration |
ICS environments typically have more statically defined devices, therefore minimize the use of both IT discovery protocols (e.g., DHCP, LLDP) and discovery functions in automation protocols.[7][8] Examples of automation protocols with discovery capabilities include OPC UA Device Discovery[9], BACnet[10], and Ethernet/IP.[11] |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0907 | Detection of Port Scan | AN2050 |
Real-time monitoring identifies execution of port scanning utilities (nmap, masscan) with arguments targeting Industrial Control System (ICS) protocol port ranges on an ICS Windows host. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
| AN2161 |
Real-time monitoring identifies execve of port scanning utilities on an Industrial Control System (ICS) Linux asset with arguments targeting ICS protocol port ranges. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2181 |
Real-time monitoring identifies a host generating rapid, sequential Transmission Control Protocol (TCP) connection attempts across multiple destination ports on Industrial Control System (ICS) device Internet Protocol (IP) addresses, targeting ICS-specific protocol ports, from a source not in the approved control server inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2226 |
Real-time monitoring identifies rapid sequential Industrial Control System (ICS) protocol connection attempts to the same field device Internet Protocol (IP) address across different protocol ports from a single source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |