Cross-source coverage

T1049 / ATT&CK

System Network Connections Discovery

29 rules across 5 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate. Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services.

Utilities and commands that acquire this information include netstat, "net use," and "net session" with Net. In Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and Network Device CLI may be used (e.g. show ip sockets, show tcp brief). On ESXi servers, the command esxi network ip connection list can be used to list active network connections.

Tactics: Discovery
Platforms: ESXi · IaaS · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SysmonWinEventLog:PowerShellauditd:SYSCALLlinux:climacos:osqueryesxi:hostdnetworkdevice:clisnmp:trapAWS:CloudTrailazure:activity

How MITRE says to detect it DET0320

Detection of System Network Connections Discovery Across Platforms

Windows Analytic 0903

Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.

WinEventLog:Sysmon EventCode=1
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106

Linux Analytic 0904

Detects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.

auditd:SYSCALL execve
linux:cli command logging

macOS Analytic 0905

Detects shell-based enumeration of active connections using `netstat`, `lsof -i`, or AppleScript-based system discovery.

macos:osquery process_events

ESXi Analytic 0906

Detects shell or API usage of `esxcli network ip connection list` or `netstat` to enumerate ESXi host connections.

esxi:hostd command log

Network Devices Analytic 0907

Detects interactive or automated use of CLI commands like `show ip sockets`, `show tcp brief`, or SNMP queries for active sessions on routers/switches.

networkdevice:cli command logs
snmp:trap management queries

IaaS Analytic 0908

Detects enumeration of cloud network interfaces, VPCs, subnets, or peer connections using CLI or SDKs (e.g., AWS CLI, Azure CLI, GCloud CLI).

AWS:CloudTrail Describe* or List* API calls
azure:activity networkInsightsLogs

View on attack.mitre.org ↗

SigmaHQ/sigma

9 rules

Detection	Severity	Format
HackTool - SharpView Execution	High	Sigma
Potential Pikabot Discovery Activity	High	Sigma
Cisco Discovery	Low	Sigma
Net.EXE Execution	Low	Sigma
System Network Connections Discovery - Linux	Low	Sigma
System Network Connections Discovery Via Net.EXE	Low	Sigma
Use Get-NetTCPConnection	Low	Sigma
Use Get-NetTCPConnection - PowerShell Module	Low	Sigma
System Network Connections Discovery - MacOs	Informational	Sigma

splunk/security_content

8 rules

Detection	Severity	Format
GetNetTcpconnection with PowerShell	Undefined	SPL
GetNetTcpconnection with PowerShell Script Block	Undefined	SPL
Network Connection Discovery With Arp	Undefined	SPL
Network Connection Discovery With Netstat	Undefined	SPL
Windows Common Abused Cmd Shell Risk Behavior	Undefined	SPL
Windows Network Connection Discovery Via Net	Undefined	SPL
Windows Post Exploitation Risk Behavior	Undefined	SPL
Windows System Network Connections Discovery Netsh	Undefined	SPL

elastic/detection-rules

6 rules

Detection	Severity	Format
Suspicious JetBrains TeamCity Child Process	Medium	Elastic TOML
Suspicious MS Office Child Process	Medium	Elastic TOML
DNS Enumeration Detected via Defend for Containers	Low	Elastic TOML
Enumeration Command Spawned via WMIPrvSE	Low	Elastic TOML
Suspicious System Commands Executed by Previously Unknown Executable	Low	Elastic TOML
Unusual Linux Network Connection Discovery	Low	Elastic TOML

socfortress/Wazuh-Rules

5 rules

Detection	Severity	Format
Possible system network connection discovery command executed (MITRE T1049)	Medium	Wazuh XML
Sysmon - Event 17: PipeEvent (Pipe Created) by · System Network Connections Discovery (T1049)	Low	Wazuh XML
Sysmon - Event 18: PipeEvent (Pipe Connected) by · System Network Connections Discovery (T1049)	Low	Wazuh XML
Sysmon - Event 1: Process creation · System Network Connections Discovery (T1049)	Low	Wazuh XML
Sysmon - Event 3: Network connection by · System Network Connections Discovery (T1049)	Low	Wazuh XML

chronicle/detection-rules

1 rule

Detection	Severity	Format
possible_system_network_connections_discovery_sysmonwindows_logs	Undefined	YARA-L