tool

ifconfig S0101

Type: tool
Created: 31 May 2017
Last modified: 25 April 2025

ifconfig is a Unix-based utility used to gather information about and interact with the TCP/IP settings on a system. [1]

TechniqueBottom 5%

TacticBottom 6%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

ifconfig MITRE reference S0101

System Network Configuration Discovery T1016 ↗

ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.

Discovery25 detection rules

Standing S0101

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique25med61st pct

61st percentile · 61% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique10medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique2med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 1 Enterprise technique.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 14Splunk ESCU (cumulative) · 11

Standing S0101

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
Splunk	The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-10-02	5db16825-81bd-4923-a8d6-d6a13a59832a
Splunk	The following analytic identifies potential enumeration of local network configuration on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon · Osquery	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2022-02-14	2026-10-02	535cb214-8b47-11ec-a2c7-acde48001122
	Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.	Hunting	test	ps_module	windows	PowerShell	Discovery Software Discovery Security Software Discovery Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-07-13	—	ea207a23-b441-4a17-9f76-ad5be47d51d3
Splunk	This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall. (...)	Anomaly	stable	process_creation	-	Osquery	Discovery System Network Configuration Discovery	-	medium	Jamie Windley, Splunk	2026-04-15	2026-10-02	f8db6e0b-55bb-40ca-bc85-2b3700adb0f8
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects instances where an SNMP service on an OpenCanary node has had an OID request.	Generic	test	-	-	OpenCanary	Lateral Movement Remote Services Discovery System Network Configuration Discovery	-	high	Security Onion Solutions	2024-03-08	—	e9856028-fd4e-46e6-b3d1-10f7ceb95078
	Detects network enumeration performed on AWS.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Discovery System Network Configuration Discovery	-	low	Janantha Marasinghe	2022-12-13	2023-03-24	c3d53999-4b14-4ddd-9d9b-e618c366b54d
	Detects system discovery activity carried out by Pikabot, such as incl. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery	-	high	Andreas Braathen (mnemonic.io)	2023-10-27	2024-01-26	698d4431-514f-4c82-af4d-cf573872a9f5
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery System Network Configuration Discovery	-	medium	Craig Young, oscd.community, Georg Lauenstein	2021-07-24	2023-12-15	5cc90652-4cbd-4241-aa3b-4b462fa5a248
Splunk	The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Configuration Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	3f0b95e3-3195-46ac-bea3-84fb59e7fac5	-
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-19	a29c1813-ab1f-4dde-b489-330b952e91ae
	Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". (...)	Generic	test	network_connection	windows	Sysmon	Discovery System Network Configuration Discovery	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-04-24	2024-03-22	edf3485d-dac4-4d50-90e4-b0e5813f7e60
	Detects enumeration of local network configuration	Generic	test	process_creation	linux	Sysmon	Discovery System Network Configuration Discovery	-	informational	Ömer Günal and remotephone, oscd.community	2020-10-06	2022-09-15	e7bd1cfa-b446-4c88-8afb-403bcd79e3fa
	Detects enumeration of local network configuration	Generic	test	process_creation	macos	-	Discovery System Network Configuration Discovery	-	informational	remotephone, oscd.community	2020-10-06	2024-08-29	58800443-f9fc-4d55-ae0c-98a3966dfb97
	Detects suspicious enumeration of the domain the user is associated with.	Placeholder	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-02-09	2024-08-01	43311e65-84d8-42a5-b3d4-c94d9b67038f
Splunk	The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)	Correlation	stable	-	-	-	Execution Command and Scripting Interpreter Defense Impairment File and Directory Permissions Modification Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Impact System Shutdown/Reboot	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a
Splunk	The following analytic identifies four or more distinct post-exploitation behaviors on a Windows system. (...)	Correlation	stable	-	-	-	Collection Clipboard Data Credential Access OS Credential Dumping Discovery Permission Groups Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Credential Access Unsecured Credentials	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	edb930df-64c2-4bb7-9b5c-889ed53fb973
Splunk	The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Michael Haag, Splunk	2025-04-17	2026-05-13	8db47e12-9c3e-4f5a-b0d6-e42a1895cd4f
Splunk	The following analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2022-12-06	2026-05-13	e24f0a0e-41a9-419f-9999-eacab15efc36
Splunk	Detects the execution of the WinPEAS PowerShell script via default function names used within the script. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information Software Client Configurations Reconnaissance Gather Victim Network Information Discovery Group Policy Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	5cb208df-e1aa-478d-ab2f-8270ff9999b9

Title

Description

ifconfig S0101

ifconfig MITRE reference S0101

Standing S0101

Reach

Coverage

ifconfig MITRE reference S0101

Standing S0101

Reach

Coverage

ifconfig detections S0101

ifconfig detections S0101