tool

netstat S0104

Type: tool
Created: 31 May 2017
Last modified: 12 May 2026

netstat is an operating system utility that displays active TCP connections, listening ports, and network statistics. [1]

TechniqueBottom 5%

TacticBottom 6%

Threat groupsunranked

Campaignsunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

netstat MITRE reference S0104

System Network Connections Discovery T1049 ↗

netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.2

Discovery17 detection rules

Standing S0104

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactic1Bottom 6%

6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.

Threat groups1161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns485% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique17med40th pct

40th percentile · 60% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique7med

netstat detections S0104

17 distinct rules cover the 1 technique recorded for this tool. 9 Sigma · 8 Splunk.

1 covered by at least one rule17 distinct rules in total

Showing 1-17 of 17 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic identifies the execution of `powershell.exe` with the `Get-NetTcpConnection` command, which lists current TCP connections on a system. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	e02af35c-1de5-4afe-b4be-f45aba57272b
Splunk	The following analytic detects the execution of the `Get-NetTcpconnection` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	091712ff-b02a-4d43-82ed-34765515d95d
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Network Share Discovery Discovery Permission Groups Discovery Domain Groups Discovery System Network Connections Discovery Discovery System Owner/User Discovery	-	high	frack113	2021-12-10	2023-02-14	b2317cfa-4a47-4ead-b3ff-297438c0bc2d
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Splunk	The following analytic detects the execution of `arp.exe` with the `-a` flag, which is used to list network connections on a compromised system. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-08-30	ae008c0f-83bd-4ed4-9350-98d4328e15d2
Splunk	The following analytic detects the execution of `netstat.exe` with command-line arguments to list network connections on a system. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	2cf5cc25-f39a-436d-a790-4857e5995ede
	Detects system discovery activity carried out by Pikabot, such as incl. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery	-	high	Andreas Braathen (mnemonic.io)	2023-10-27	2024-01-26	698d4431-514f-4c82-af4d-cf573872a9f5
	Detects usage of system utilities to discover system network connections	Generic	test	process_creation	linux	Sysmon	Discovery System Network Connections Discovery	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2023-01-17	4c519226-f0cd-4471-bd2f-6fbb2bb68a79
	Detects usage of system utilities to discover system network connections	Generic	test	process_creation	macos	-	Discovery System Network Connections Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-12-28	9a7a0393-2144-4626-9bf1-7c2f5a7321db
	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Connections Discovery	-	low	frack113	2021-12-10	2023-02-21	1c67a717-32ba-409b-a45d-0fb704a73a81
	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.	Generic	test	ps_classic_start	windows	PowerShell	Discovery System Network Connections Discovery	-	low	frack113	2021-12-10	2023-10-27	b366adb4-d63d-422d-8a2c-186463b5ded0
	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.	Generic	test	ps_module	windows	PowerShell	Discovery System Network Connections Discovery	-	low	frack113	2021-12-10	2022-12-02	aff815cc-e400-4bf0-a47a-5d8a2407d4e1
Splunk	The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)	Correlation	stable	-	-	-	Execution Command and Scripting Interpreter Defense Impairment File and Directory Permissions Modification Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Impact System Shutdown/Reboot	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a
Splunk	The following analytic identifies the execution of `net.exe` with command-line arguments used to list or display information about computer connections. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	86a5b949-679b-4197-8d4c-9c180a818c45
Splunk	The following analytic identifies four or more distinct post-exploitation behaviors on a Windows system. (...)	Correlation	stable	-	-	-	Collection Clipboard Data Credential Access OS Credential Dumping Discovery Permission Groups Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Credential Access Unsecured Credentials	-	medium	Teoderick Contreras, Splunk	2023-06-14	2026-05-13	edb930df-64c2-4bb7-9b5c-889ed53fb973
Splunk	The following analytic detects the execution of the Windows built-in tool netsh.exe to display the state, configuration, and profile of the host firewall. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Teoderick Contreras, Splunk	2022-12-06	2026-10-02	abfb7cc5-c275-4a97-9029-62cd8d4ffeca

Standing S0104

Title

Description