Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)   

Within cloud environments, adversaries may attempt to discover services running on other cloud hosts. Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.

Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network. The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network. For example, adversaries can use a mDNS query (such as <code>dns-sd -B _ssh._tcp .</code>) to find other systems broadcasting the ssh service.(Citation: apple doco bonjour description)(Citation: macOS APT Activity Bradley)
Network Service Discovery
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1046  external_id: T1046     source_name: apple doco bonjour description  description: Apple Inc. (2013, April 23). Bonjour Overview. Retrieved October 11, 2021.  url: https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/NetServices/Introduction.html     source_name: CISA AR21-126A FIVEHANDS May 2021  description: CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.  url: https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a     source_name: macOS APT Activity Bradley  description: Jaron Bradley. (2021, November 14). What does APT Activity Look Like on macOS?. Retrieved January 19, 2022.  url: https://themittenmac.com/what-does-apt-activity-look-like-on-macos/     