/
Alert Pack: Network Service Discovery (MITRE Att&ck Technique: T1046)
Document toolboxDocument toolbox

Alert Pack: Network Service Discovery (MITRE Att&ck Technique: T1046)

Owned by Juan Tomás Alonso Nieto (Deactivated)
May 08, 2023
2 min read
[ 1 Purpose ] [ 2 Prerequisites ] [ 3 Open alert pack ] [ 4 Use alert pack ]

Purpose

Network Service Discovery is very important to be detected because it lets the SOC know that you have a potential attacker within your system that is trying to discover the layout for your infrastructure. This is a crucial step in causing disruption and issues for your business and customers. When an attacker has infiltrated a network device they will often use the techniques in T1046 to find out what devices are being used, and which are vulnerable to exploitation.

These alerts will help your team to detect those adversaries and respond to any potential issues they have caused. Use these alerts to help bolster the detection capabilities of Devo and provide a quicker MTTR.

Security Operations application

SecOps users can obtain detailed information if they install these alerts using the Content Manager instead.

SecOpsLog4ShellVulnerabilityCloudAzure

SecOpsFWPortScanInternalSource

SecOpsAwsECRContainerScanningFindingsCritical

SecOpsFWSMBInboundScanningDetected

SecOpsFWExcessFirewallDeniesOutbound

SecOpsAWSExcessiveSecurityScanning

SecOpsFWIpScanInternal

SecOpsLog4ShellVulnOverDomainsUnionTableConnectionsWithLookup

SecOpsAWSECRContainerScanningFindingsLowInformationalUnknown

SecOpsFWPortSweepInternalSource

 

 

 

What is Network Service Discovery?

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.

Prerequisites

To use this alert pack, you must have the following data sources available in your domain:

Open alert pack

Once you have installed the alert pack, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find it and later manage it as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).

Use alert pack

The alerts in the alert pack are deactivated by default when the alert pack is installed. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.