---
{
  "title": "Network Service Discovery",
  "summary": "Network service discovery identifies reachable services and ports on other systems.",
  "topic": "forensics",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1046"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1046: Network Service Discovery",
      "url": "https://attack.mitre.org/techniques/T1046"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Network service discovery identifies reachable services and ports on other systems. It can guide exploitation or movement after a foothold is established.


## An investigation example

A workstation with an unexpected login probes a group of internal servers across several service ports.

## Evidence to examine

Review fan-out patterns, source process, scan timing, targeted services, and any subsequent authentication or execution.

## A common analytical pitfall

Approved vulnerability scanners and monitoring tools can produce similar patterns; verify identity and scope.

## Response considerations

Investigate the source access and downstream attempts, and validate segmentation against the services actually reached.


## Reachability and service identity need separate evidence

Service discovery identifies available network services, often by observing responses from addresses and ports. A responding port is a clue about a service, not conclusive proof of a particular product or vulnerability. Firewalls, proxies, load balancers, and application configuration affect the response. Authentication and authorization still determine what a requester can do afterward.

Authorized inventory and vulnerability-management tools perform similar discovery. Compare source systems, approved schedules, target scope, and the pattern of requests. A familiar scanner name does not grant permission, while an unfamiliar tool is not automatically malicious. The investigation should explain why the activity fits or conflicts with the expected role.

## A fictional internal probing pattern

An academy sees a staff workstation contact many internal service ports shortly after unusual execution. Analysts correlate network records with endpoint ancestry and identity activity. They compare the behavior with scheduled management scans and examine any later access attempts. The discovery pattern can indicate target selection without demonstrating successful exploitation.

Failed or filtered responses also need interpretation. Silence may reflect packet loss, filtering, an offline host, or the observation point's limitations. Do not label every unresponsive port closed without understanding the method and evidence. Preserve the time window because services and network policy can change after the event.

## Interpret prepared results

Use a fictional table containing successful responses, explicit refusals, and timeouts. Explain what each supports and what remains uncertain. Then add an approved scanning window and an unexpected source host. Decide what context is needed before escalating. Do not probe public or organizational systems without authorization.

A good finding keeps discovery, application identification, vulnerability assessment, and successful access distinct. These stages can be connected in a broader intrusion, but each requires its own support. That separation makes reports more accurate and helps responders choose a proportionate next step.

## Related concepts

- [[digital-forensics]]
- [[incident-timeline]]
- [[logs-and-telemetry]]