What is service discovery?¶
Service discovery is activity used to identify software services, applications or network functions available on a system or across an environment.
Avoid the dangerous assumption¶
The dangerous assumption is that detecting a service proves it was exploited or accessed.
It does not.
An offender may look for:
- remote desktop
- file sharing
- databases
- web applications
- directory services
- administrative interfaces
- backup systems
- security products
- remote-management services.
Evidence may include:
- port scans
- service enumeration
- banner requests
- process listings
- configuration queries
- network connections
- management-platform records
- application logs.
Investigators should establish:
- which service was identified
- how it was queried
- whether it responded
- whether authentication was attempted
- whether access succeeded
- what activity followed.
A service may appear available but be protected, restricted or unusable from the source.
Likewise, a response may reveal only limited information.
Legitimate monitoring, asset inventory and vulnerability scanning can produce similar activity.
Compare the timing, source, account and target pattern with normal operational behaviour.
Service discovery can help explain why the offender later selected a particular access route.
It does not prove the service was vulnerable or used successfully.
Service discovery may be broad or selective. A systematic scan across many systems may indicate automation, while repeated queries against one service may show focused interest or troubleshooting. Preserve enough surrounding activity to distinguish the two.
Check whether the service-identification method itself altered the target or generated defensive alerts. Aggressive scanning can create effects that later need to be separated from offender activity.
Operational takeaway¶
Treat service discovery as evidence of identifying available functions, and prove authentication, exploitation or use separately from the discovery event.