What is network discovery?¶
Network discovery is activity used to identify devices, services, routes, addresses and relationships within a network.
Avoid the dangerous assumption¶
The dangerous assumption is that any scanning or connection attempt proves an attack.
Network administrators, monitoring tools and security scanners perform similar activity.
An offender may use network discovery to identify:
- other devices
- servers
- domain controllers
- open ports
- remote services
- network shares
- gateways
- security appliances
- cloud connections
- segmented environments.
Evidence may include:
- connection attempts
- address sweeps
- port scans
- name-resolution requests
- routing commands
- service enumeration
- firewall and proxy records
- endpoint process activity
- network-monitoring alerts.
Investigators should establish:
- which device initiated the activity
- which account or process was involved
- what range or targets were tested
- whether the activity was automated
- what services responded
- what happened afterwards.
A scan may show attempted discovery without proving successful access to any target.
Likewise, an isolated connection may be routine application behaviour rather than reconnaissance.
Compare the pattern with normal network-management and security activity.
The timing may be important. Discovery immediately after a suspicious login or exploit may support the incident sequence.
Do not assume that the apparent source device was physically controlled by the offender. It may itself have been compromised or remotely managed.
Also preserve records showing which targets responded. A scan across many addresses may be broad reconnaissance, while later connections to only a few responding systems may show how targets were selected.
Operational takeaway¶
Use network discovery evidence to show what systems and services were searched for, while separating scanning, response and later access into distinct stages.