tool

Ping S0097

Type: tool
Created: 31 May 2017
Last modified: 12 May 2026

Ping is an operating system utility commonly used to troubleshoot and verify network connections. [1]

TechniqueBottom 5%

TacticBottom 6%

Threat groupsunranked

Campaignsunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Ping MITRE reference S0097

Remote System Discovery T1018 ↗

Ping can be used to identify remote systems within a network.2

Discovery39 detection rules

Standing S0097

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat groups1561% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns485% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique39medTop 14%

86th percentile · 86% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique23med

Ping detections S0097

39 distinct rules cover the 1 technique recorded for this tool. 22 Splunk · 17 Sigma.

1 covered by at least one rule39 distinct rules in total

Showing 1-39 of 39 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	64c7adaa-48ee-483c-b0d6-7175bc65e6cc
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	c5a31f80-5888-4d81-9f78-1cc65026316e
Splunk	The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	a9a1da02-8e27-4bf7-a348-f4389c9da487
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	ed550c19-712e-43f6-bd19-6f58f61b3a5e
Splunk	The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	f64da023-b988-4775-8d57-38e512beb56e
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-DomainController` command, which is used to discover remote systems within a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	868ee0e4-52ab-484a-833a-6d85b7c028d0
Splunk	The following analytic detects the execution of the `Get-DomainController` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	676b600a-a94d-4951-b346-11329431e6c1
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
Splunk	The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	29b99201-723c-4118-847a-db2b3d3fb8ea
	Detects execution of the hacktool NetExec. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services Discovery Remote System Discovery	-	high	Chirag Damani	2026-03-29	—	7638e5fe-600c-4289-a968-f49dd537ec7d
	Detects the enumeration of other remote systems.	Generic	test	process_creation	linux	Sysmon	Discovery Remote System Discovery	-	low	Alejandro Ortuno, oscd.community	2020-10-22	2021-11-27	11063ec2-de63-4153-935e-b1a8b9e616f1
	Detects the enumeration of other remote systems.	Generic	test	process_creation	macos	-	Discovery Remote System Discovery	-	informational	Alejandro Ortuno, oscd.community	2020-10-22	2021-11-27	10227522-8429-47e6-a301-f2b2d014e7ad
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.	Generic	experimental	ps_script	windows	PowerShell	Reconnaissance Gather Victim Identity Information Email Addresses Discovery Remote System Discovery Credential Access Steal or Forge Kerberos Tickets	-	medium	frack113	2025-03-05	—	cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
	Detects AdFind execution with common flags seen used during attacks	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community	2021-02-02	2025-10-24	9a132afa-654e-11eb-ae93-0242ac130002
	This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of int (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Remote System Discovery	-	low	frack113	2022-01-01	2023-02-21	26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell scripts to query Active Directory for domain computers. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	70803451-0047-4e12-9d63-77fa7eb8649c
Splunk	The following analytic detects the execution of `dsquery.exe` with the `computer` argument, which is used to discover remote systems within a domain. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	9fb562f4-42f8-4139-8e11-a82edf7ed718
Splunk	The following analytic detects the execution of `wmic.exe` with specific command-line arguments used to discover remote systems within a domain. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	d82eced3-b1dc-42ab-859e-a2fc98827359
	Detects the use of a renamed Adfind.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups Discovery Remote System Discovery	-	high	Florian Roth (Nextron Systems)	2022-08-21	2025-02-26	df55196f-f105-44d3-a675-e9dfb6cc2f2b
	Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Discovery Remote System Discovery	-	low	Endgame, JHasenbusch (ported for oscd.community)	2018-10-30	2023-02-21	62510e69-616b-4078-b371-847da438cc03
	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery Remote System Discovery	-	medium	frack113	2022-03-12	—	f8ad2e2c-40b6-4117-84d7-20b89896ab23
	Detects certain command line parameters often used during reconnaissance activity via web shells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson	2017-01-01	2026-07-14	bed2a484-9348-4143-8a8a-b801c979301c
	Detects certain parent child patterns found in cases in which a web shell is used to perform certain (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	-	high	Florian Roth (Nextron Systems)	2022-03-17	2023-11-09	4ebc877f-4612-45cb-b3a5-8e3834db36c9
Splunk	The following analytic identifies the execution of `adfind.exe` standalone or with specific command-line arguments related to Active Directory queries. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Jose Hernandez, Bhavin Patel, Nasreddine Bencherchali, Splunk	2020-12-17	2026-10-02	bd3b0187-189b-46c0-be45-f52da2bae67f
Splunk	The following analytic detects the use of the Get-ADComputer cmdlet with parameters indicating a search for Windows endpoints with Kerberos Unconstrained Delegation. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2022-03-28	2026-05-13	c8640777-469f-4638-ab44-c34a3233ffac
Splunk	Detects usage of the Netspy scanner on an endpoint. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Reconnaissance Active Scanning Discovery Remote System Discovery	-	medium	Raven Tait, Splunk	2021-05-07	2026-05-13	f3ee1ff4-38ab-451e-8dfc-659dea57045f
Splunk	The following analytic detects the use of PowerView commandlets to discover Windows endpoints with Kerberos Constrained Delegation. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2022-03-28	2026-05-13	86dc8176-6e6c-42d6-9684-5444c6557ab3
Splunk	The following analytic detects the use of PowerView commandlets to discover Windows endpoints with Kerberos Unconstrained Delegation. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2022-03-28	2026-05-13	fbf9e47f-e531-4fea-942d-5c95af7ed4d6
Splunk	The following analytic identifies execution of Sysinternals PsTools and Sysinternals Suit binaries t (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Remote System Discovery Discovery System Information Discovery	-	medium	Nasreddine Bencherchali	2025-10-24	2026-05-13	9a5f4b3e-1d2b-4c6f-9a8e-3b7d2f5c1a6e

Standing S0097

Title

Description