Cross-source coverage

T1016.001 / ATT&CK

System Network Configuration Discovery: Internet Connection Discovery

8 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth.

Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.

Tactics
Discovery
Platforms
Windows · Linux · macOS · ESXi
Telemetry
WinEventLog:SysmonWinEventLog:PowerShellWinEventLog:Securityauditd:EXECVElinux:syslogmacos:unifiedlogesxi:shellesxi:hostd

How MITRE says to detect it DET0357

Behavioral Detection of Internet Connection Discovery

Windows Analytic 1015

Execution of utilities (e.g., ping, tracert, Test-NetConnection) or scripted methods to test Internet connectivity by interacting with external IPs/domains.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • WinEventLog:Security EventCode=5156, 5157

Linux Analytic 1016

Execution of ping, traceroute, or curl/wget against public IPs/domains to verify Internet reachability.

  • auditd:EXECVE execve
  • linux:syslog network

macOS Analytic 1017

Execution of ping, traceroute, or network utility tools to external destinations; may include `scutil` or system_profiler.

  • macos:unifiedlog process

ESXi Analytic 1018

Execution of `ping`, `vmkping`, or `curl` from shell or through automation jobs/scripts to verify Internet egress.

  • esxi:shell None
  • esxi:hostd process

View on attack.mitre.org ↗

elastic/detection-rules

5 rules
Detection Severity Format
System Public IP Discovery via DNS Query High Elastic TOML
DNS Request for IP Lookup Service via Unsigned Binary Medium Elastic TOML
Enumeration Command Spawned via WMIPrvSE Low Elastic TOML
External IP Address Discovery via Curl Low Elastic TOML
Suspicious PDF Reader Child Process Low Elastic TOML

elastic/protections-artifacts

1 rule
Detection Severity Format
Potential HawkEyes Stealer Infection Undefined Elastic TOML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Internet Connectivity Check using ping (T1016.001) High Wazuh XML

splunk/security_content

1 rule
Detection Severity Format
Network Discovery Using Route Windows App Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.