CAPEC-292: Host Discovery
Description
An adversary sends a probe to an IP address to determine if the host is alive. Host discovery is one of the earliest phases of network reconnaissance. The adversary usually starts with a range of IP addresses belonging to a target network and uses various methods to determine if a host is present at that IP address. Host discovery is usually referred to as 'Ping' scanning using a sonar analogy. The goal is to send a packet through to the IP address and solicit a response from the host. As such, a 'ping' can be virtually any crafted packet whatsoever, provided the adversary can identify a functional host based on its response. An attack of this nature is usually carried out with a 'ping sweep,' where a particular kind of ping is sent to a range of IP addresses.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Low
- Abstraction
- StandardA specific methodology or technique used in an attack.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The adversary requires logical access to the target network in order to carry out host discovery.
Consequences
- Confidentiality
Other
- ConfidentialityAccess ControlAuthorization
Bypass Protection Mechanism; Hide Activities
Mitigations
CAPEC 3.9 lists no mitigation for this pattern; see its child patterns or related weaknesses.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SFASystem File Analysis1 shared
- D3-HBPIHardware-based Process Isolation1 shared
- D3-PSAProcess Spawn Analysis1 shared
- D3-SCASystem Call Analysis1 shared
- D3-EALExecutable Allowlisting1 shared
- D3-EDLExecutable Denylisting1 shared
- D3-SCFSystem Call Filtering1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
Related attack patterns
Parent
More specific patterns
- CAPEC-285ICMP Echo Request PingDetailed
- CAPEC-294ICMP Address Mask RequestDetailed
- CAPEC-295Timestamp RequestDetailed
- CAPEC-296ICMP Information RequestDetailed
- CAPEC-297TCP ACK PingDetailed
- CAPEC-298UDP PingDetailed
- CAPEC-299TCP SYN PingDetailed
- CAPEC-612WiFi MAC Address TrackingDetailed
- CAPEC-613WiFi SSID TrackingDetailed
- CAPEC-618Cellular Broadcast Message RequestDetailed
- CAPEC-619Signal Strength TrackingDetailed