tfMITRE ATT&CK technique

System Network Configuration Discovery T1016

Tactic: Discovery
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Version: 1.7
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Austin Clark, @c2defense

Sub-techniques 226 rules across the family · 25 mapped directly to T1016 · 1 of 2 carry rules

.001Internet Connection Discovery1 .002Wi-Fi Discovery0

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 3%

Threat groups97th percentile · 97% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 2%

Campaigns98th percentile · 98% of ATT&CK techniques have this many campaigns recorded or fewer.

232

Tools & malwareTop 1%

Tools & malware99th percentile · 99% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 11%

Detection rules89th percentile · 89% of ATT&CK techniques have this many detection rules written or fewer.

System Network Configuration Discovery MITRE reference T1016

Top 3%of all ATT&CK techniques for number of groups

44 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has collected machine names and IP addresses by parsing the process scheduler configuration file psappsrv.cfg.1

created 2026-07-291 referenceaka UNC6240

MirrorFaceG1054 ↗

Has used ipconfig for reconnaissance.1

created 2026-04-171 referenceaka Earth Kasha

Medusa GroupG1051 ↗

Has obtained host network details utilizing the command cmd.exe /c ipconfig /all.1

created 2025-10-151 reference

APT42G1044 ↗

Has used malware, such as GHAMBAR and POWERPOST, to collect network information.1

created 2025-01-081 reference

BlackByteG1043 ↗

Used tools such as Arp to pull system network information and identify connected devices.1 2

created 2024-12-162 referencesaka Hecamede

PlayG1040 ↗

Has used the information-stealing tool Grixba to enumerate network information.1

created 2024-09-241 reference

All 44 groups for this technique · 6 newest in this preview

13 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Anthropic AI-orchestrated CampaignC0062 ↗

During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices.1

2025

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries gathered network configuration details utilizing arp -a and nslookup commands. 1

2025

RedPenguinC0056 ↗

During RedPenguin, UNC3886 leveraged JunoOS CLI queries to obtain the interface index which contains system and network details.1 2

2024–2025

ShadowRayC0045 ↗

During ShadowRay, threat actors invoked DNS queries from targeted machines to identify their IP addresses.1

2023–2024

KV Botnet ActivityC0035 ↗

Gathers victim IP information during initial installation stages.1

2022–2024

C0018C0018 ↗

During C0018, the threat actors ran nslookup and Advanced IP Scanner on the target network.1

2022

All 13 campaigns for this technique · 6 newest in this preview

232 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has discovered network configuration through the use of system commands to include ip addr, and ip route.1

created 2026-07-29MALWAREcarried by 1 group

CanisterWormS9042 ↗

Has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.1

created 2026-07-24MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Has the ability to enumerate network interfaces.1 2

created 2026-07-01MALWAREcarried by 1 group

LAMEHUGS9035 ↗

Can enumerate network information on compromised hosts.1

created 2026-04-21MALWAREcarried by 1 group

LODEINFOS9020 ↗

Can enumerate the MAC address of the compromised host.1

created 2026-04-17MALWAREcarried by 1 group

evilginx2S9003 ↗

Can capture information from each session with a victim including the public IP used to access the server and the user agent.1

created 2026-01-30TOOL

All 232 software entries for this technique · 6 newest in this preview

Offense vs defense T1016

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 12Sigma rules (cumulative) · 14Splunk ESCU (cumulative) · 11

first rule: 2019 Q3 · 12 of 13 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2016 window)

System Network Configuration Discovery detection strategy DET0195

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of System Network Configuration Discovery

Enterprise

5 platforms

AN0559 · Windows

Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcess	Filter known/legit CLI chains (e.g., explorer.exe → cmd.exe) to reduce FP
UserContext	Target executions by non-admin or unexpected users
TimeWindow	Cluster enumeration commands within short time windows

AN0560 · Linux

Execution of ifconfig, ip a, or access to /proc/net/ indicating collection of local interface and route configuration.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLinePattern	Match regex for variations in enumeration syntax (e.g., `ip -4 addr show`)
InteractiveShellIndicator	Differentiate scripted versus interactive sessions

AN0561 · macOS

Execution of ifconfig, networksetup, or system_profiler to query IP/MAC/interface configuration and status.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptedContext	Scripted tools (e.g., bash calling `ifconfig`) vs GUI-initiated inspection
ExecutionFrequency	Enumerations executed frequently or across multiple interfaces may indicate enumeration loops

AN0562 · ESXi

Use of esxcli network commands (e.g., esxcli network nic list, esxcli network ip interface ipv4 get) via SSH or hostd to enumerate adapter and IP information.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:hostd	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SSHSessionOrigin	Detection may vary based on internal vs remote terminal usage
esxcliCommandDepth	Distinguish between benign status checks and deep enumeration chains

AN0563 · Network Devices

CLI-based execution of interface and routing discovery commands (e.g., show ip interface, show arp, show route) over Telnet, SSH, or console.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:cli	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Username	Highlight low-privileged or non-routine users performing discovery
CommandString	Allow for tuning based on command regex or frequency
TransportType	SSH vs Telnet vs Console session logging scope

2 analytics

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.

TypeTTPCoverageModerateSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	command_line
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

process = search Process:Create
info_command = filter process where (
 exe == "hostname.exe" or
 exe == "ipconfig.exe" or
 exe == "net.exe" or
 exe == "quser.exe" or
 exe == "qwinsta.exe" or
 exe == "sc" and (command_line match " query" or command_line match " qc")) or
 exe == "systeminfo.exe" or
 exe == "tasklist.exe" or
 exe == "whoami.exe"
)
output info_command

Splunk version of the above pseudocode search.

index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName

EQL version of the above pseudocode search.

process where subtype.create and
  (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))

Tests9Executorscmd 6 · sh 1 · PowerShell 1 · bash 1Need elevation1 of 9Have prerequisites4Have cleanup1Platformswindows, macos, linux

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 System Network Configuration Discovery on Windows windows cmd — — —

Identify network configuration information Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.

Attack command

ipconfig /all
netsh interface show interface
arp -a
nbtstat -n
net config

GUID5755a223-8bd4-4ae6-b9e6-68a961a61424

02 List Windows Firewall Rules windows cmd — — —

Enumerates Windows Firewall Rules using netsh. Upon successful execution, cmd.exe will spawn netsh.exe to list firewall rules. Output will be via stdout.

Attack command

netsh advfirewall firewall show rule name=all

GUID3902dfcf-f56e-4119-a613-1759b1f002aa

03 System Network Configuration Discovery macos, linux sh — 1 —

Identify network configuration information. Upon successful execution, sh will spawn multiple commands and output will be via stdout.

Attack command

if [ "$(uname)" = 'FreeBSD' ]; then cmd="netstat -Sp tcp"; else cmd="netstat -ant"; fi;
if [ -x "$(command -v arp)" ]; then arp -a; else echo "arp is missing from the machine. skipping..."; fi;
if [ -x "$(command -v ifconfig)" ]; then ifconfig; else echo "ifconfig is missing from the machine. skipping..."; fi;
if [ -x "$(command -v ip)" ]; then ip addr; else echo "ip is missing from the machine. skipping..."; fi;
if [ -x "$(command -v netstat)" ]; then $cmd | awk '{print $NF}' | grep -v '[[:lower:]]' | sort | uniq -c; else echo "netstat is missing from the machine. skipping..."; fi;

Prerequisite

Check if arp command exists on the machine

Check

if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;

Satisfy

(which yum && yum -y install net-tools)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y net-tools)

GUID3380bffe-9244-4243-89d3-4e82334f8b93

04 System Network Configuration Discovery (TrickBot Style) windows cmd — — —

Identify network configuration information as seen by Trickbot and described here https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/ Upon successful execution, cmd.exe will spawn ipconfig /all, net config workstation, net view /all /domain, nltest /domain_trusts. Output will be via stdout.

Attack command

ipconfig /all
net config workstation
net view /all /domain
nltest /domain_trusts

GUID1d435586-ab44-4ffc-ad43-64eb2011b620

05 List Open Egress Ports windows PowerShell — 1 Yes

This is to test for what ports are open outbound. The technique used was taken from the following blog: https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/ Upon successful execution, powershell will read top-128.txt (ports) and contact each port to confirm if open or not. Output will be to Desktop\open-ports.txt.

Input arguments

Name	Type	Default	Description
port_file	path	PathToAtomicsFolder\T1016\src\top-128.txt	The path to a text file containing ports to be scanned, one port per line. The default list uses the top 128 ports as defined by Nmap.
output_file	path	$env:USERPROFILE\Desktop\open-ports.txt	Path of file to write port scan results
portfile_url	url	https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1016/src/top-128.txt	URL to top-128.txt

Attack command

$ports = Get-content "#{port_file}"
$file = "#{output_file}"
$totalopen = 0
$totalports = 0
New-Item $file -Force
foreach ($port in $ports) {
    $test = new-object system.Net.Sockets.TcpClient
    $wait = $test.beginConnect("allports.exposed", $port, $null, $null)
    $wait.asyncwaithandle.waitone(250, $false) | Out-Null
    $totalports++ | Out-Null
    if ($test.Connected) {
        $result = "$port open" 
        Write-Host -ForegroundColor Green $result
        $result | Out-File -Encoding ASCII -append $file
        $totalopen++ | Out-Null
    }
    else {
        $result = "$port closed" 
        Write-Host -ForegroundColor Red $result
        $totalclosed++ | Out-Null
        $result | Out-File -Encoding ASCII -append $file
    }
}
$results = "There were a total of $totalopen open ports out of $totalports ports tested."
$results | Out-File -Encoding ASCII -append $file
Write-Host $results

Cleanup command

Remove-Item -ErrorAction ignore "#{output_file}"

Prerequisite

Test requires #{port_file} to exist

Check

if (Test-Path "#{port_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{port_file}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "#{portfile_url}" -OutFile "#{port_file}"

GUIDa1fc23b2-a726-4fd0-ac17-fcae781cf87a

06 Adfind - Enumerate Active Directory Subnet Objects windows cmd — 1 —

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Input arguments

Name	Type	Default	Description
optional_args	string	—	Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.

Attack command

"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=subnet) #{optional_args}

Prerequisite

AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe"

GUID6bc82d0d-5a87-4773-bb67-6cf07aff0d95

07 Qakbot Recon windows cmd — 1 —

A list of commands known to be performed by Qakbot for recon purposes

Input arguments

Name	Type	Default	Description
recon_commands	path	PathToAtomicsFolder\T1016\src\qakbot.bat	File that houses list of commands to be executed

Attack command

"#{recon_commands}"

Prerequisite

File to copy must exist on disk at specified location (#{recon_commands})

Check

if (Test-Path "#{recon_commands}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{recon_commands}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1016/src/qakbot.bat" -OutFile "#{recon_commands}"

GUIDfba205f5-f8aa-4ef3-b361-829d8eeedef4

08 List macOS Firewall Rules macos bash Required — —

"This will test if the macOS firewall is enabled and/or show what rules are configured. Must be run with elevated privileges. Upon successful execution, these commands will output various information about the firewall configuration, including status and specific port/protocol blocks or allows. Using defaults, additional arguments can be added to see filtered details, such as globalstate for global configuration (\"Is it on or off?\"), firewall for common application allow rules, and explicitauths for specific rules configured by the user. Using socketfilterfw, flags such as --getglobalstate or --listapps can be used for similar filtering. At least one flag is required to send parseable output to standard out.

Attack command

sudo defaults read /Library/Preferences/com.apple.alf
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

GUIDb1fcfc9a-eab4-403e-899c-266067b2bd9f

09 DNS Server Discovery Using nslookup windows cmd — — —

Identify System domain dns controller on an endpoint using nslookup ldap query. This tool is being abused by qakbot malware to gather information on the domain controller of the targeted or compromised host. reference https://securelist.com/qakbot-technical-analysis/103931/

Attack command

nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%USERDNSDOMAIN%

GUID62e58f57-19a3-486a-822b-84004bf16337

Tests from Atomic Red Team (MIT licence) · technique definition

System Network Configuration Discovery detections T1016

25 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 11%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs