tool

nbtstat S0102

Type: tool
Created: 31 May 2017
Last modified: 12 May 2026

nbtstat is a utility used to troubleshoot NetBIOS name resolution. [1]

TechniquesBottom 7%

TacticBottom 6%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

nbtstat MITRE reference S0102

System Network Configuration Discovery T1016 ↗

nbtstat can be used to discover local NetBIOS domain names.

Discovery25 detection rules

System Network Connections Discovery T1049 ↗

nbtstat can be used to discover current NetBIOS sessions.

Discovery17 detection rules

Standing S0102

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques2Bottom 7%

7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat groups261% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique21med49th pct

49th percentile · 51% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique8.5med

nbtstat detections S0102

38 distinct rules cover the 2 techniques recorded for this tool. 21 Sigma · 17 Splunk.

2 covered by at least one rule38 distinct rules in total

Showing 1-38 of 38 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
Splunk	The following analytic identifies the execution of `powershell.exe` with the `Get-NetTcpConnection` command, which lists current TCP connections on a system. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	e02af35c-1de5-4afe-b4be-f45aba57272b
Splunk	The following analytic detects the execution of the `Get-NetTcpconnection` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	091712ff-b02a-4d43-82ed-34765515d95d
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Network Share Discovery Discovery Permission Groups Discovery Domain Groups Discovery System Network Connections Discovery Discovery System Owner/User Discovery	-	high	frack113	2021-12-10	2023-02-14	b2317cfa-4a47-4ead-b3ff-297438c0bc2d
Splunk	The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-10-02	5db16825-81bd-4923-a8d6-d6a13a59832a
Splunk	The following analytic identifies potential enumeration of local network configuration on Linux systems. (...)	Anomaly	stable	process_creation	linux	Sysmon · Osquery	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2022-02-14	2026-10-02	535cb214-8b47-11ec-a2c7-acde48001122
	Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.	Hunting	test	ps_module	windows	PowerShell	Discovery Software Discovery Security Software Discovery Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-07-13	—	ea207a23-b441-4a17-9f76-ad5be47d51d3
Splunk	This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall. (...)	Anomaly	stable	process_creation	-	Osquery	Discovery System Network Configuration Discovery	-	medium	Jamie Windley, Splunk	2026-04-15	2026-10-02	f8db6e0b-55bb-40ca-bc85-2b3700adb0f8
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Splunk	The following analytic detects the execution of `arp.exe` with the `-a` flag, which is used to list network connections on a compromised system. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-08-30	ae008c0f-83bd-4ed4-9350-98d4328e15d2
Splunk	The following analytic detects the execution of `netstat.exe` with command-line arguments to list network connections on a system. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	2cf5cc25-f39a-436d-a790-4857e5995ede
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Remote System Discovery Discovery System Network Configuration Discovery	-	low	Arun Chauhan	2023-02-03	—	903076ff-f442-475a-b667-4f246bcc203b
	Detects instances where an SNMP service on an OpenCanary node has had an OID request.	Generic	test	-	-	OpenCanary	Lateral Movement Remote Services Discovery System Network Configuration Discovery	-	high	Security Onion Solutions	2024-03-08	—	e9856028-fd4e-46e6-b3d1-10f7ceb95078
	Detects network enumeration performed on AWS.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Discovery System Network Configuration Discovery	-	low	Janantha Marasinghe	2022-12-13	2023-03-24	c3d53999-4b14-4ddd-9d9b-e618c366b54d
	Detects system discovery activity carried out by Pikabot, such as incl. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery	-	high	Andreas Braathen (mnemonic.io)	2023-10-27	2024-01-26	698d4431-514f-4c82-af4d-cf573872a9f5
	Detects nltest commands that can be used for information discovery	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery System Network Configuration Discovery	-	medium	Craig Young, oscd.community, Georg Lauenstein	2021-07-24	2023-12-15	5cc90652-4cbd-4241-aa3b-4b462fa5a248
Splunk	The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Configuration Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	3f0b95e3-3195-46ac-bea3-84fb59e7fac5	-
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-19	a29c1813-ab1f-4dde-b489-330b952e91ae
	Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". (...)	Generic	test	network_connection	windows	Sysmon	Discovery System Network Configuration Discovery	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-04-24	2024-03-22	edf3485d-dac4-4d50-90e4-b0e5813f7e60
	Detects usage of system utilities to discover system network connections	Generic	test	process_creation	linux	Sysmon	Discovery System Network Connections Discovery	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2023-01-17	4c519226-f0cd-4471-bd2f-6fbb2bb68a79
	Detects usage of system utilities to discover system network connections	Generic	test	process_creation	macos	-	Discovery System Network Connections Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-12-28	9a7a0393-2144-4626-9bf1-7c2f5a7321db
	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Connections Discovery	-	low	frack113	2021-12-10	2023-02-21	1c67a717-32ba-409b-a45d-0fb704a73a81
	Detects enumeration of local network configuration	Generic	test	process_creation	linux	Sysmon	Discovery System Network Configuration Discovery	-	informational	Ömer Günal and remotephone, oscd.community	2020-10-06	2022-09-15	e7bd1cfa-b446-4c88-8afb-403bcd79e3fa
	Detects enumeration of local network configuration	Generic	test	process_creation	macos	-	Discovery System Network Configuration Discovery	-	informational	remotephone, oscd.community	2020-10-06	2024-08-29	58800443-f9fc-4d55-ae0c-98a3966dfb97
	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.	Generic	test	ps_classic_start	windows	PowerShell	Discovery System Network Connections Discovery	-	low	frack113	2021-12-10	2023-10-27	b366adb4-d63d-422d-8a2c-186463b5ded0
	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.	Generic	test	ps_module	windows	PowerShell	Discovery System Network Connections Discovery	-	low	frack113	2021-12-10	2022-12-02	aff815cc-e400-4bf0-a47a-5d8a2407d4e1
	Detects suspicious enumeration of the domain the user is associated with.	Placeholder	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-02-09	2024-08-01	43311e65-84d8-42a5-b3d4-c94d9b67038f
Splunk	The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)	Correlation	stable	-	-	-	Execution Command and Scripting Interpreter Defense Impairment File and Directory Permissions Modification Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Impact System Shutdown/Reboot	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a
Splunk	The following analytic identifies the execution of `net.exe` with command-line arguments used to list or display information about computer connections. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	86a5b949-679b-4197-8d4c-9c180a818c45
Splunk	The following analytic identifies four or more distinct post-exploitation behaviors on a Windows system. (...)	Correlation	stable	-	-	-	Collection Clipboard Data Credential Access OS Credential Dumping Discovery Permission Groups Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Credential Access Unsecured Credentials	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	edb930df-64c2-4bb7-9b5c-889ed53fb973
Splunk	The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Michael Haag, Splunk	2025-04-17	2026-05-13	8db47e12-9c3e-4f5a-b0d6-e42a1895cd4f
Splunk	The following analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Configuration Discovery	-	medium	Teoderick Contreras, Splunk	2022-12-06	2026-05-13	e24f0a0e-41a9-419f-9999-eacab15efc36
Splunk	The following analytic detects the execution of the Windows built-in tool netsh.exe to display the state, configuration, and profile of the host firewall. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Teoderick Contreras, Splunk	2022-12-06	2026-10-02	abfb7cc5-c275-4a97-9029-62cd8d4ffeca
Splunk	Detects the execution of the WinPEAS PowerShell script via default function names used within the script. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information Software Client Configurations Reconnaissance Gather Victim Network Information Discovery Group Policy Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	5cb208df-e1aa-478d-ab2f-8270ff9999b9

Standing S0102

Title

Description