Cross-source coverage
T1016 / ATT&CK
System Network Configuration Discovery
73 rules · 72 families across 8 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface). On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command esxcli network nic list will retrieve the MAC address, while esxcli network ip interface ipv4 get will retrieve the local IPv4 address.
Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
- Tactics
- Discovery
- Platforms
- ESXi · Linux · macOS · Network Devices · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:PowerShellauditd:EXECVEmacos:unifiedlogesxi:hostdnetworkdevice:cli
How MITRE says to detect it DET0195
Behavioral Detection of System Network Configuration Discovery
Windows Analytic 0559
Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.
WinEventLog:SysmonEventCode=1WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
Linux Analytic 0560
Execution of `ifconfig`, `ip a`, or access to `/proc/net/` indicating collection of local interface and route configuration.
auditd:EXECVEexecve
macOS Analytic 0561
Execution of `ifconfig`, `networksetup`, or `system_profiler` to query IP/MAC/interface configuration and status.
macos:unifiedlogprocess
ESXi Analytic 0562
Use of `esxcli network` commands (e.g., `esxcli network nic list`, `esxcli network ip interface ipv4 get`) via SSH or hostd to enumerate adapter and IP information.
esxi:hostdNone
Network Devices Analytic 0563
CLI-based execution of interface and routing discovery commands (e.g., `show ip interface`, `show arp`, `show route`) over Telnet, SSH, or console.
networkdevice:cliNone
Sub-techniques with coverage
Counted in the 73 above — a rule tagged a sub-technique covers this technique too.
elastic/detection-rules
20 rules| Detection | Severity | Format |
|---|---|---|
| Potential Meterpreter Reverse Shell | High | Elastic TOML |
| System Public IP Discovery via DNS Query | High | Elastic TOML |
| Wireless Credential Dumping using Netsh Command | High | Elastic TOML |
| Discovery Command Output Written to Suspicious File | Medium | Elastic TOML |
| DNS Request for IP Lookup Service via Unsigned Binary | Medium | Elastic TOML |
| Suspicious Instance Metadata Service (IMDS) API Command Line Execution | Medium | Elastic TOML |
| Suspicious Instance Metadata Service (IMDS) API Request | Medium | Elastic TOML |
| Suspicious JetBrains TeamCity Child Process | Medium | Elastic TOML |
| Suspicious MS Office Child Process | Medium | Elastic TOML |
| System and Network Configuration Check | Medium | Elastic TOML |
+ 10 more from elastic/detection-rules → showing the 10 highest-severity
socfortress/Wazuh-Rules
20 rules · 19 families| Detection | Severity | Format |
|---|---|---|
| Internet Connectivity Check using ping (T1016.001) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · AdFind subnet enumeration (T1016) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · ARP command execution (T1016) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · DNS controller discovery with nslookup (T1016) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · IPConfig execution (T1016) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · NBTSTAT execution (T1016) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · NET CONFIG usage (T1016) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · NETSH interface show (T1016) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · netsh wlan profile dump (T1016.002) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · NLTEST domain trusts (T1016) | High | Wazuh XML |
+ 10 more from socfortress/Wazuh-Rules → showing the 10 highest-severity
SigmaHQ/sigma
12 rules| Detection | Severity | Format |
|---|---|---|
| OpenCanary - SNMP OID Request | High | Sigma |
| Potential Pikabot Discovery Activity | High | Sigma |
| Potential Recon Activity Via Nltest.EXE | Medium | Sigma |
| Suspicious Network Connection to IP Lookup Service APIs | Medium | Sigma |
| Cisco Discovery | Low | Sigma |
| Firewall Configuration Discovery Via Netsh.EXE | Low | Sigma |
| Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet | Low | Sigma |
| Nltest.EXE Execution | Low | Sigma |
| Suspicious Network Command | Low | Sigma |
| Userdomain Variable Enumeration | Low | Sigma |
+ 2 more from SigmaHQ/sigma → showing the 10 highest-severity
splunk/security_content
12 rules| Detection | Severity | Format |
|---|---|---|
| Cisco IOS XE Reconnaissance Command Activity | Undefined | SPL |
| Cisco NVM - Suspicious Network Connection to IP Lookup Service API | Undefined | SPL |
| Linux Auditd System Network Configuration Discovery | Undefined | SPL |
| Linux System Network Discovery | Undefined | SPL |
| MacOS List Firewall Rules | Undefined | SPL |
| Network Discovery Using Route Windows App | Undefined | SPL |
| Potential System Network Configuration Discovery Activity | Undefined | SPL |
| Windows Common Abused Cmd Shell Risk Behavior | Undefined | SPL |
| Windows Post Exploitation Risk Behavior | Undefined | SPL |
| Windows PowerShell Invoke-RestMethod IP Information Collection | Undefined | SPL |
+ 2 more from splunk/security_content → showing the 10 highest-severity
elastic/protections-artifacts
3 rules| Detection | Severity | Format |
|---|---|---|
| External IP Address Discovery via a Trusted Program | Undefined | Elastic TOML |
| External IP Address Discovery via Untrusted Program | Undefined | Elastic TOML |
| Potential HawkEyes Stealer Infection | Undefined | Elastic TOML |
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| Powershell executed "NetWkstaGetInfo". Possible network configuration discovery | Low | Wazuh XML |
| Powershell queried Win32_ComputerSystem. Possible system discovery activity | Low | Wazuh XML |
chainguard-dev/osquery-defense-kit
2 rules| Detection | Severity | Format |
|---|---|---|
| Suspicious parenting of fetch tools (event-based) | Undefined | osquery SQL |
| Suspicious parenting of network utilities (event-based) | Undefined | osquery SQL |
chronicle/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| recon_environment_enumeration_network_cisa_report | Low | YARA-L |
| possible_system_network_configuration_discovery_sysmonwindows_logs | Undefined | YARA-L |