tool
NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.[1][2][3][4]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
23rd percentile · 77% of 825 ATT&CK software entries have more Enterprise techniques.
12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
80th percentile · 80% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
97th percentile · 97% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 5 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
143 distinct rules cover the 5 techniques recorded for this tool. 86 Sigma · 57 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory. | Generic | test | ps_script | windows | PowerShell | - | low | frack113 | 2022-03-17 | 2023-07-08 | 36bed6b2-e9a0-4fff-beeb-413a92b86138 | ||||
Splunk | The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Splunk | 2025-10-24 | 2026-05-13 | 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5 | |||
Detects the use of Advanced IP Scanner. (...) | Generic | test | file_event | windows | Sysmon | - | medium | @ROxPinTeddy | 2020-05-12 | 2022-11-29 | fed85bf9-e075-4280-9159-fbe8a023d6fa | ||||
Splunk | The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-09-14 | 2026-05-13 | a9079b18-1633-11ec-859c-acde48001122 | - | ||
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | high | Florian Roth (Nextron Systems), MSTI (query) | 2022-10-01 | — | fa3c117a-bc0d-416e-a31b-0c0e80653efb | |||||
Splunk | This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f | |||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Splunk | This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | 71ac5328-2364-40cf-8381-92b8dc531399 | |||
Splunk | This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | efb20922-17bc-4fb0-880c-be50cfc100dd | |||
Splunk | This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Janantha Marasinghe | 2025-07-01 | 2026-09-22 | 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f | |||
Splunk | The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 17e9b764-3a2b-4d36-9751-32d13ce4718b | |||
Splunk | The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 1f57f10e-1dc5-47ea-852c-2e85b2503d79 | |||
Show when a monitor or a span/rspan is setup or modified | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-11 | 2023-01-04 | b9e1f193-d236-4451-aaae-2f3d2102120d | - | |||
Splunk | This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...) | Anomaly | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | b0ce5521-2533-4f24-b8d5-c2ff977aae08 | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-10 | 2022-11-17 | 435e10e4-992a-4281-96f3-38b11106adde | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | ps_script | windows | PowerShell | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-17 | — | db885529-903f-4c5d-9864-28fe199e6370 | ||||
Enumerates Active Directory to determine computers that are joined to the domain | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-02-12 | — | 1f6399cf-2c80-4924-ace1-6fcff3393480 | ||||
Splunk | The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-07-20 | 41243735-89a7-4c83-bcdd-570aa78f00a1 | |||
Splunk | The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | 64c7adaa-48ee-483c-b0d6-7175bc65e6cc | |||
Detects the execution of "whoami.exe" with the "/all" flag | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2023-12-04 | 2024-03-05 | c248c896-e412-4279-8c15-1c558067b6fa | ||||
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration. | Generic | test | process_creation | linux | Sysmon | - | medium | Cedric Maurugeon | 2023-09-04 | — | 33e814e0-1f00-4e43-9c34-31fb7ae2b174 | ||||
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon | 2023-09-04 | — | f41dada5-3f56-4232-8503-3fb7f9cf2d60 | ||||
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | Cedric Maurugeon | 2023-09-04 | — | e80273e1-9faf-40bc-bd85-dbaff104c4e9 | ||||
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs. | Generic | test | process_creation | linux | Sysmon | - | medium | Cedric Maurugeon | 2023-09-04 | — | 5f1573a7-363b-4114-9208-ad7a61de46eb | ||||
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon | 2023-09-04 | — | d54c2f06-aca9-4e2b-81c9-5317858f4b79 | ||||
Adversaries may look for details about the network configuration and settings of systems they access (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' | 2021-12-07 | 2025-10-18 | 0e4164da-94bc-450d-a7be-a4b176179f1f | ||||
Detects AS-REP roasting is an attack that is often-overlooked. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-03-17 | — | 96c982fe-3d08-4df4-bed2-eb14e02f21c8 | ||||
Splunk | The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | c5a31f80-5888-4d81-9f78-1cc65026316e | |||
Splunk | The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...) | Hunting | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-10-02 | a9a1da02-8e27-4bf7-a348-f4389c9da487 | |||
Splunk | The following analytic detects the execution of `powershell.exe` with command-line arguments invoking the `GetCurrent` method of the WindowsIdentity .NET class. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-08-24 | 2026-10-02 | 7eb9c3d5-c98c-4088-acc5-8240bad15379 | |||
Splunk | The following analytic detects the execution of the `GetCurrent` method from the WindowsIdentity .NET class using PowerShell Script Block Logging (EventCode=4104). (...) | Hunting | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-08-24 | 2026-10-02 | 80879283-c30f-44f7-8471-d1381f6d437a | |||
Splunk | The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | ed550c19-712e-43f6-bd19-6f58f61b3a5e | |||
Splunk | The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | f64da023-b988-4775-8d57-38e512beb56e | |||
Splunk | The following analytic detects the execution of `powershell.exe` with the `Get-DomainController` command, which is used to discover remote systems within a Windows domain. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-10-02 | 868ee0e4-52ab-484a-833a-6d85b7c028d0 | |||
Splunk | The following analytic detects the execution of the `Get-DomainController` commandlet using PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | 676b600a-a94d-4951-b346-11329431e6c1 | |||
Splunk | The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-10-02 | 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3 | |||
Splunk | The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | 29b99201-723c-4118-847a-db2b3d3fb8ea | |||
Detects execution of the Grixba reconnaissance tool based on suspicious command-line parameter combinations. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-11-26 | — | af688c76-4ce4-4309-bfdd-e896f01acf27 | ||||
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-02-28 | — | bd8b828d-0dca-48e1-8a63-8a58ecf2644f | ||||
Detects execution of the hacktool NetExec. (...) | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Chirag Damani | 2026-03-29 | — | 7638e5fe-600c-4289-a968-f49dd537ec7d | ||||
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-08-29 | 2023-02-04 | d9367cbb-c2e0-47ce-bdc0-128cb6da898d | ||||
Adversaries may look for details about the network configuration and settings of systems they access (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2021-12-10 | 2023-02-14 | b2317cfa-4a47-4ead-b3ff-297438c0bc2d | ||||
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Georg Lauenstein (sure[secure]) | 2022-09-19 | 2023-03-23 | 98b53e78-ebaf-46f8-be06-421aafd176d9 | ||||
Detects commandline keywords indicative of potential usge of the tool WinPwn. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel | 2023-12-04 | — | d557dc06-62e8-4468-a8e8-7984124908ce | ||||
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...) | Generic | test | ps_script | windows | PowerShell | - | high | Swachchhanda Shrawan Poudel | 2023-12-04 | — | 851fd622-b675-4d26-b803-14bc7baa517a | ||||
Detect the harvesting of wifi credentials using netsh.exe | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Andreas Hunkeler (@Karneades), oscd.community | 2020-04-20 | 2023-02-13 | 42b1a5b8-353f-4f10-b256-39de4467faff | ||||
Splunk | This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. (...) | Generic | stable | network_connection | - | AWS · Cisco Secure Firewall · Cisco | - | medium | Dean Luxton | 2024-07-01 | 2026-05-13 | 1ff9eb9a-7d72-4993-a55e-59a839e607f1 | - | ||
Splunk | This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using on of the NMAP top 20 ports. (...) | Generic | stable | network_connection | - | AWS · Cisco Secure Firewall · Cisco | - | medium | Dean Luxton | 2024-07-01 | 2026-09-08 | 3141a041-4f57-4277-9faa-9305ca1f8e5b | - | ||
Splunk | This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. (...) | Generic | stable | network_connection | - | AWS · Cisco Secure Firewall · Cisco | - | medium | Dean Luxton, Splunk | 2020-01-19 | 2026-05-13 | 40d2dc41-9bbf-421a-a34b-8611271a6770 | - | ||
Splunk | This analytic detects internal hosts triggering multiple IDS signatures, which may include either more than 25 signatures against a single host or a single signature across over 25 destination IP addresses. (...) | Generic | experimental | ids | - | - | - | medium | Dean Luxton | 2024-07-01 | 2026-05-13 | 46f946ed-1c78-4e96-9906-c7a4be15e39b | - |