Threat intelligence / Technique

Network Service Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp . ) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port, vulnerability, and/or wordlist scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021) Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well. Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp . ) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)

77 recorded

Relationships

mapped-to

from Port Scanning

Technique

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Network Intrusion Prevention

Mitigation

mitigates

from Network Segmentation

Mitigation

uses

from 2025 Poland Wiper Attacks

Campaign

uses

Group

uses

from Anthropic AI-orchestrated Campaign

Campaign

uses

from APT32

Group

uses

from APT39

Group

uses

from APT41

Group

uses

from BackdoorDiplomacy

Group

uses

from Backdoor.Oldrea

Malware

uses

Malware

uses

Group

uses

from BlackByte Ransomware

Malware

uses

from BlackEnergy

Malware

uses

Group

uses

from Brute Ratel C4

Tool

uses

from C0018

Campaign

uses

from C0027

Campaign

uses

from Caterpillar WebShell

Malware

uses

Group

uses

from China Chopper

Malware

uses

from Cobalt Group

Group

uses

from Cobalt Strike

Malware

uses

Malware

uses

from CostaRicto

Campaign

uses

from DarkVishnya

Group

uses

from Ember Bear

Group

uses

Tool

uses

from FIN13

Group

uses

from FIN6

Group

uses

from Fox Kitten

Group

uses

from FRP

Tool

uses

from HDoor

Malware

uses

from HermeticWizard

Malware

uses

Malware

uses

from HomeLand Justice

Campaign

uses

from INC Ransom

Group

uses

from Industroyer

Malware

uses

from InvisiMole

Malware

uses

Tool

uses

from Lazarus Group

Group

uses

Group

uses

Malware

uses

from Lotus Blossom

Group

uses

Malware

uses

from Magic Hound

Group

uses

from Medusa Group

Group

uses

Group

uses

from MgBot

Malware

uses

Malware

uses

from Mustang Panda

Group

uses

Group

uses

Tool

uses

Group

uses

from Operation Wocao

Campaign

uses

from P.A.S. Webshell

Malware

uses

Tool

uses

Tool

uses

from Pupy

Tool

uses

from Pysa

Malware

uses

Malware

uses

Group

uses

Malware

uses

from Rocke

Group

uses

from Royal

Malware

uses

from SILENTTRINITY

Tool

uses

Malware

uses

Group

uses

Group

uses

from Threat Group-3390

Group

uses

from Tropic Trooper

Group

uses

from Volt Typhoon

Group

uses

from Xbash

Malware

uses

Malware

uses

Malware

4 external

References

mitre-attack

T1046

apple doco bonjour description

https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/NetServices/Introduction.html

CISA AR21-126A FIVEHANDS May 2021

https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a

macOS APT Activity Bradley

https://themittenmac.com/what-does-apt-activity-look-like-on-macos/