SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Network and infrastructure attacks

Port scanning / service discovery

SYN, connect, FIN, Xmas, Null, UDP probes map attack surface

categoryNetwork and infrastructure attacksseverityLowdetectability (measured in our lab)Mediumlabdetected in lab

Example: nmap

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1046 · Port-Scanning /24 Subnet with PowerShell · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1046 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1046 -TestGuids 05df2a79-dba6-4088-a804-9ca0802ca8e4 -TimeoutSeconds 120'
ATT&CK T1046 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1046 -Tool atomic -RunId run-2026-10-14-015 -Command 'Invoke-AtomicTest T1046 -TestGuids 05df2a79-dba6-4088-a804-9ca0802ca8e4 -TimeoutSeconds 120'
ATT&CK T1046 · Atomic Red Team
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1046 -Tool atomic -RunId run-2026-10-18-016 -Command 'Invoke-AtomicTest T1046 -TestGuids 05df2a79-dba6-4088-a804-9ca0802ca8e4 -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-30 · detected in 86s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1PowerShell port scan: TcpClient / Test-NetConnection -Port connect inside a host/port loop (network service discovery) -- T1046
Event · EID 102The database engine is starting a new instance.
Sysmon · EID 11C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder
Sysmon · EID 11Executable file dropped in folder commonly used by malware
Event · EID 300The database engine is initiating recovery steps.
Event · EID 301The database engine is replaying log file C:\Winnt\system32\wins\j50.log.
Event · EID 302The database engine has completed recovery steps.
Event · EID 326The database engine attached a database.
… and 12 more event type(s)

Detection that fired

  • ✓ Wazuh 100432 (level 6) lab rule — PowerShell port scan: TcpClient / Test-NetConnection -Port connect inside a host/port loop (network service discovery) -- T1046
  • ✓ Wazuh 100433 (level 6) lab rule — PowerShell port scan: TcpClient / Test-NetConnection -Port connect inside a host/port loop (network service discovery) (Security 4688 arm) -- T1046

Plus 21 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~8576 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-27 · detected in 8s

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 1Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1Powershell process spawned powershell instance
Sysmon · EID 11Executable file dropped in folder commonly used by malware
Sysmon · EID 3Possible suspicious access to Windows admin shares
Sysmon · EID 3Windows System process activity over SMB port - Possible suspicious access to Windows admin shares
PowerShell · EID 4104Powershell script querying system environment variables
PowerShell · EID 4104Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104Powershell script searching filesystem
… and 6 more event type(s)

Detection that fired

  • ✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 15 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~60025 incidental alerts/hour — tune against this.

Classification

29 values: 11 reviewed, 2 lab-measured, 12 imported, 4 derived. What do these mean?

Exploitability

Attack vectorNetwork attacks
Reach (CVSS)Network
Attack complexityLow
Privileges requiredNone
User interactionNone
Attacker skill requiredLow
Resources requiredLow
Likelihood / prevalenceHigh
MaturityCommoditized

Impact & scope

SeverityLow
ImpactConfidentiality
PlatformContainersIaaSLinuxmacOSNetwork DevicesWindows
EnvironmentCloudOn-premises
Target asset classNetwork deviceServer
Kill-chain phase (tactic)Discovery

Detection & telemetry

Detectability (measured in our lab)Medium
Detectability (public detection content)High
Noise levelHigh
TestabilityAtomic Red Team test
Data sources (ATT&CK data components)Network Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess Creation

Detection & response

Mitigated by 3

Detected by 23

  • DET0376 attack-detection-strategy
  • 3761e026-f259-44e6-8826-719ed8079408 sigma
  • 3e102cd9-a70d-4a7a-9508-403963092f31 sigma
  • 4fd6b1c7-19b8-4488-97f6-00f0924991a3 sigma
  • 54773c5f-f1cc-4703-9126-2f797d96a69d sigma
  • 68b8547b-107f-43f3-97fb-900a7d63c190 sigma
  • 84bae5d4-b518-4ae0-b331-6d4afd34d00f sigma
  • 851fd622-b675-4d26-b803-14bc7baa517a sigma
  • 974be8d2-283e-4033-ab08-7505b84204d0 sigma
  • 97de11cd-4b67-4abf-9a8b-1020e670aa9e sigma
  • 98b53e78-ebaf-46f8-be06-421aafd176d9 sigma
  • af688c76-4ce4-4309-bfdd-e896f01acf27 sigma
  • bef0bc5a-b9ae-425d-85c6-7b2d705980c6 sigma
  • bef37fa2-f205-4a7b-b484-0759bfd5f86f sigma
  • ca387a8e-1c84-4da3-9993-028b45342d30 sigma
  • d557dc06-62e8-4468-a8e8-7984124908ce sigma
  • d7553d7b-f485-479c-b192-cdac6edd83a4 sigma
  • e8a677fd-248c-4eab-94df-de2f6f645884 sigma
  • eae8c0c8-e5da-450a-9d7d-66aa56cd26b6 sigma
  • f6ecd1cf-19b8-4488-97f6-00f0924991a3 sigma
  • fed85bf9-e075-4280-9159-fbe8a023d6fa sigma
  • 100432 wazuh
  • 100433 wazuh

Tested by 13

  • 05df2a79-dba6-4088-a804-9ca0802ca8e4 atomic
  • 06eaafdb-8982-426e-8a31-d572da633caa atomic
  • 0d5a2b03-3a26-45e4-96ae-89485b4d1f97 atomic
  • 1cca5640-32a9-46e6-b8e0-fabbe2384a73 atomic
  • 32c268dd-96a7-4530-817c-848534a39d09 atomic
  • 515942b0-a09f-4163-a7bb-22fefb6f185f atomic
  • 54574908-f1de-4356-9021-8053dd57439a atomic
  • 68e907da-2539-48f6-9fc9-257a78c05540 atomic
  • 6ca45b04-9f15-4424-b9d3-84a217285a5c atomic
  • 97585b04-5be2-40e9-8c31-82157b8af2d6 atomic
  • 9e55750e-4cbf-4013-9627-e9a045b541bf atomic
  • bb037826-cbe8-4a41-93ea-b94059d6bb98 atomic
  • d696a3cb-d7a8-4976-8eb5-5af4abf2e3df atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-14-015partially-detectedatomicwindows2026-10-14
run-2026-10-18-016partially-detectedatomicwindows2026-10-18
run-2026-10-27-010partially-detectedatomicwindows2026-10-27
run-2026-10-30-001detectedatomicwindows2026-10-30
  • run-2026-10-14-015 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1046 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
  • run-2026-10-18-016 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1046 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1531 max_level=15 dwell_s=90
  • run-2026-10-27-010 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1046 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1584 max_level=15 dwell_s=90
  • run-2026-10-30-001 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1046 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=243 max_level=15 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 186 of Cyber-Attack-Taxonomy.md
  • ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 73 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
  • ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-015 (partially-detected) for T1046: no alert matched the expected technique
  • ev-0004 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-016 (partially-detected) for T1046: no alert matched the expected technique
  • ev-0005 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-010 (partially-detected) for T1046: no alert matched the expected technique
  • ev-0006 (Phase 4 detection lab - detonation runs 2026-10-30) — Lab detonation run-2026-10-30-001 (detected): Wazuh rule(s) 100432, 100433 fired on T1046 within the detonation window
    PowerShell port scan: TcpClient / Test-NetConnection -Port connect inside a host/port loop (network service discovery) -- T1046