{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91",
  "created": "2026-04-20T20:54:21.726Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T0846/003",
      "external_id": "T0846.003"
    },
    {
      "source_name": "Cisco Active Discovery",
      "description": "Cisco Systems, Inc.. (2024, March 5). Cisco Cyber Vision Active Discovery Configuration Guide, Release 4.3.0. Retrieved April 23, 2026.",
      "url": "https://www.cisco.com/c/en/us/td/docs/security/cyber_vision/publications/Active-Discovery/Release-4-3-0/b_Cisco_Cyber_Vision_Active_Discovery_Configuration_Guide.pdf"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2026-05-12T15:12:00.636Z",
  "name": "Multicast Discovery",
  "description": "Adversaries may perform multicast discovery requests which is when one system or device sends messages to all systems and devices in a pre-defined group on a network (or subnet) and then waits for a response. If a response is received that means the system or device that responded is live and can communicate over that protocol.  Multicast discovery tends to be stealthier than broadcast discovery because every system or device on the network (or subnet) is not being messaged. \n\nOne common OT protocol that has a multicast discovery mechanism is the Process Field Network (PROFINET) Discovery and Configuration Protocol (DCP) with its Identify All requests.(Citation: Cisco Active Discovery)\n",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-ics-attack",
      "phase_name": "discovery"
    }
  ],
  "x_mitre_attack_spec_version": "3.3.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "ics-attack"
  ],
  "x_mitre_is_subtechnique": true,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_version": "1.0"
}