Network Connection Enumeration (T0840) is an adversary on an OT host reading its connection table to learn which devices talk to which, and therefore what role each device plays in the process. On an HMI or engineering workstation, a list of open connections is a ready-made map: the controllers it polls, the historian it writes to, the engineering ports it reaches. MITRE ATT&CK for ICS lists T0840 under Discovery for Embedded, Windows, Linux and Network Devices platforms. The technique mirrors Enterprise T1049, and the host-side defence is largely the same, so this page is deliberately short: it covers what is different in OT, the procedure examples ATT&CK records, the v20 detection analytics and a safe response. For the Enterprise detail see the T1049 System Network Connections Discovery guide, and for the wider matrix the MITRE ATT&CK for ICS Guide.
Key takeaways
- It uses built-in tools. ATT&CK names netstat as the typical method, and records attackers running it on HMI computers in the 2025 attacks on Poland's energy sector.
- Prevention is not really available. ATT&CK assigns M0816 Mitigation Limited or Not Effective, because the commands are standard operating system utilities.
- Detection depends on who runs it. The v20 analytics alert on enumeration commands from accounts or sources outside an approved list, not on the commands themselves.
- Embedded devices leak topology too. ATT&CK's embedded analytic watches for topology queries, such as CIP Port Object requests, from sources that are not approved SCADA servers.
- It is an early warning. Enumeration on an OT host usually precedes lateral movement or impact, so a confirmed alert justifies a full host investigation.
What T0840 covers and what differs in OT
ATT&CK for ICS describes T0840 as adversaries performing network connection enumeration to discover information about device communication patterns. By inspecting the state of connections with tools such as netstat, an adversary can work out the role of devices on the network, and can combine this with Network Sniffing (T0842) to see source, destination, protocol and content. The related host-level technique in Enterprise ATT&CK is T1049.
Three things change in an industrial network:
- Connections reveal function, not just topology. In OT, traffic patterns are stable and purpose-specific. A long-lived connection from an HMI to a controller on an industrial protocol port tells an adversary which controller runs which part of the process.
- The same commands are part of normal support. Integrators and control engineers run netstat and arp while commissioning and troubleshooting, so a simple command alert drowns operators in noise.
- Some devices answer topology questions on the wire. Field devices and switches can report neighbour lists, port information or management data to any host that asks, which is why ATT&CK's v20 strategy includes embedded and network device analytics.
Procedure examples in ATT&CK
| Example | What ATT&CK records | Lesson for defenders |
|---|---|---|
| 2025 Poland Wiper Attacks (C0063) | The adversaries used netstat to enumerate network connections on Mikronika HMI computers | HMIs need process creation logging and an approved administrator list like any server |
| Industroyer (S0604) | Its IEC 61850 module enumerates all connected network adapters to determine their TCP/IP subnet masks | Malware on a substation host can derive its own target range without any network noise first |
| EKANS (S0605) | Performs a DNS lookup of an internal domain name associated with its target network to confirm it was deployed on the intended system | Internal DNS logs on OT-adjacent domains are a useful detection source |
CERT Polska's report on the 29 December 2025 incidents adds context: on the combined heat and power plant network the attackers used PsExec to write process lists, netstat output, routing tables and the ARP cache to a file, and used built-in ping and nslookup alongside port and IP scanners. The entry point was internet-exposed VPN devices that allowed logins without multi-factor authentication. The point for T0840 is that enumeration was quiet and used built-in tools; it was the account and remote execution context that stood out.
Detection: ATT&CK v20 analytics
MITRE's v20 detection strategy for T0840 (DET0770) has four analytics, all with an OT operational fidelity gate: do not alert on enumeration alone; alert when the source role is not authorised for discovery and the scope or behaviour departs from the operational baseline, and suppress normal SCADA, HMI and historian polling, commissioning, asset inventory, backup, diagnostics and approved engineering work.
| Platform | What the analytic looks for | Data needed |
|---|---|---|
| Windows | Several network enumeration commands (netstat, arp -a, Get-NetTCPConnection) in sequence within a short window, from an account not associated with documented network administration | Sysmon Event ID 1 process creation |
| Linux | Enumeration tools (ss, netstat, arp, ip neigh) launched by a UID that does not normally perform network administration | Linux audit execve records |
| Network devices | SNMP walks, CDP or LLDP enumeration, or ICMP traceroute sequences from an ICS host that has not previously generated management traffic | Switch and router logs; SNMP requests from outside the approved network management subnet |
| Embedded | ICS protocol queries for topology information, such as neighbour lists or CIP Port Object Get_Attribute_All requests, from a source not on the approved SCADA server list | Network content inspection with protocol decoding |
The tunable inputs ATT&CK lists are an approved network administrators list, an approved SCADA servers list for topology queries, and an enumeration time window. Agreeing those lists with control engineers is most of the work. See the OT Network Security Monitoring Guide.
Prevention and hardening
Because ATT&CK rates mitigation as limited, the useful controls reduce who can reach an OT host's shell and what a foothold can learn:
- Control interactive and remote execution: limit RDP, SSH and remote execution tools on HMIs and engineering workstations to named accounts from a jump host. The Poland report records default administrator passwords on HMIs used over RDP. See the HMI and SCADA Server Hardening Guide.
- Turn off discovery services that are not needed: disable LLDP and CDP on OT switch ports facing end devices where operations do not rely on them, and restrict SNMP to the management subnet with non-default community strings or SNMPv3.
- Segment so that a map is less useful: if each zone can only reach the conduits it needs, knowledge of connections does not translate into reach. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Where identity fits
The v20 analytics key on the account. Shared HMI logins, default local administrator passwords and integrator accounts that never expire make the "approved network administrators" list meaningless. Give engineers and integrators named accounts, remove defaults, and keep service accounts on historians and jump hosts from logging on interactively. See the OT and ICS Identity and Access Guide.
How to implement
- Turn on telemetry: Sysmon process creation on Windows OT hosts and audit execve rules on Linux OT hosts, after testing on a non-production HMI for performance impact.
- Build the allowlists of network administrators, approved tools and approved SCADA query sources with operations.
- Deploy the analytics in alert-only mode through a maintenance cycle, suppressing activity tied to change tickets (our recommendation).
- Tune and promote to the OT SOC queue once noise is understood. See the OT Security Operations Centre Guide.
- Roll back by disabling the alert rule or reducing logging scope if a host shows performance impact; telemetry changes do not touch the process.
Responding to an alert
Do not isolate an HMI operators depend on without operations agreeing. Confirm with the account owner whether the commands were planned work. If not, preserve the host's process creation history, logon events and any output files, then look for what followed: remote execution, new firewall rules, connections to controllers or file share access. Contain at the conduit by restricting the host's onward access and disable the account used. See the OT Incident Response Guide.
Detection and measurement
- Telemetry coverage: percentage of HMIs, engineering workstations and OT servers with process creation logging forwarded.
- Allowlist coverage: percentage of OT hosts with a documented list of accounts allowed to run network administration tools.
- Unexplained enumeration: count of DET0770-style alerts not matched to a change ticket, each closed with a finding.
- Discovery services exposed: number of OT switch ports with LLDP, CDP or SNMP open beyond the management subnet.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK for ICS v20 | T0840; M0816; DET0770; related T0842 | Technique, mitigation rating and analytics |
| MITRE ATT&CK Enterprise v20 | T1049 System Network Connections Discovery | Host-level equivalent |
| NIST SP 800-53 Rev. 5 | SI-4 System Monitoring, AU-2 Event Logging, AC-6 Least Privilege, CM-7 Least Functionality | Monitoring, logging, account restriction and disabling unneeded services |
| NIST CSF 2.0 | DE.CM-01, DE.CM-09 | Network and platform monitoring |
Common failure patterns
- No process logging on HMIs: the host where enumeration happens is the one with no telemetry.
- Alerting on every netstat: engineers run it daily, so the rule is muted and real activity is missed.
- Default and shared administrator accounts: the account check behind the analytics cannot work.
- Management protocols open to every host: SNMP and LLDP answer anyone on the segment.
Practitioner checklist
- Enable process creation logging on Windows and Linux OT hosts and forward it to the OT SOC.
- Document approved network administrators and tools for each OT zone.
- Alert on enumeration sequences from unapproved accounts, with change ticket suppression.
- Restrict SNMP to the management subnet and disable unneeded LLDP and CDP.
- Monitor topology queries to field devices from non-SCADA sources.
- Remove default and shared administrator accounts on HMIs.
- Treat confirmed enumeration as the start of an investigation, not a closed alert.
Standards and references
- MITRE ATT&CK for ICS: Network Connection Enumeration (T0840)
- MITRE ATT&CK: Detection of Network Connection Enumeration (DET0770)
- MITRE ATT&CK: System Network Connections Discovery (T1049)
- MITRE ATT&CK: 2025 Poland Wiper Attacks (C0063)
- CERT Polska: Energy Sector Incident Report, 29 December
- ESET: Win32/Industroyer, A new threat for industrial control systems
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · T1049 System Network Connections Discovery · OT Network Security Monitoring Guide · HMI and SCADA Server Hardening Guide