Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface).[1][2] On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command esxcli network nic list will retrieve the MAC address, while esxcli network ip interface ipv4 get will retrieve the local IPv4 address.[3]
Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Threat groups97th percentile · 97% of ATT&CK techniques have fewer threat groups attributed.
13
CampaignsTop 2%
Campaigns98th percentile · 97% of ATT&CK techniques have fewer campaigns recorded.
232
Tools & malwareTop 1%
Tools & malware99th percentile · 99% of ATT&CK techniques have fewer tools implementing them.
25
Detection rulesTop 11%
Detection rules89th percentile · 89% of ATT&CK techniques have fewer detection rules written.
System Network Configuration Discovery MITRE reference T1016
Top 3%of all ATT&CK techniques for number of groups
44 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices.1
Gathers victim IP information during initial installation stages.1
2022–2024
All 13 campaigns for this technique · 6 newest in this preview
232 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
System Network Configuration Discovery detection strategy DET0195
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of System Network Configuration Discovery
Enterprise
5 platforms
AN0559 · Windows
Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ScriptedContext
Scripted tools (e.g., bash calling ifconfig) vs GUI-initiated inspection
ExecutionFrequency
Enumerations executed frequently or across multiple interfaces may indicate enumeration loops
AN0562 · ESXi
Use of esxcli network commands (e.g., esxcli network nic list, esxcli network ip interface ipv4 get) via SSH or hostd to enumerate adapter and IP information.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
Username
Highlight low-privileged or non-routine users performing discovery
CommandString
Allow for tuning based on command regex or frequency
TransportType
SSH vs Telnet vs Console session logging scope
2 analytics
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
TypeTTPCoverageLowSubmitted2013
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include
When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.
TypeTTPCoverageModerateSubmitted2016
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.
process = search Process:Create
info_command = filter process where (
exe == "hostname.exe" or
exe == "ipconfig.exe" or
exe == "net.exe" or
exe == "quser.exe" or
exe == "qwinsta.exe" or
exe == "sc" and (command_line match " query" or command_line match " qc")) or
exe == "systeminfo.exe" or
exe == "tasklist.exe" or
exe == "whoami.exe"
)
output info_command
Splunk version of the above pseudocode search.
index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName
EQL version of the above pseudocode search.
process where subtype.create and
(process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))
Tests10Executorscommand_prompt 6 · powershell 2 · sh 1 · bash 1Need elevation1 of 10Have prerequisites4Have cleanup1Platformswindows, macos, linux
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
System Network Configuration Discovery on Windows
windows
command_prompt
—
—
—
Identify network configuration information
Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.
Attack Commandsrun with command_prompt
ipconfig /all
netsh interface show interface
arp -a
nbtstat -n
net config
GUID970ab6a1-0157-4f3f-9a73-ec4166754b23
02
List Windows Firewall Rules
windows
command_prompt
—
—
—
Enumerates Windows Firewall Rules using netsh.
Upon successful execution, cmd.exe will spawn netsh.exe to list firewall rules. Output will be via stdout.
Attack Commandsrun with command_prompt
netsh advfirewall firewall show rule name=all
GUID038263cb-00f4-4b0a-98ae-0696c67e1752
03
System Network Configuration Discovery
macos, linux
sh
—
1
—
Identify network configuration information.
Upon successful execution, sh will spawn multiple commands and output will be via stdout.
Attack Commandsrun with sh
if [ "$(uname)" = 'FreeBSD' ]; then cmd="netstat -Sp tcp"; else cmd="netstat -ant"; fi;
if [ -x "$(command -v arp)" ]; then arp -a; else echo "arp is missing from the machine. skipping..."; fi;
if [ -x "$(command -v ifconfig)" ]; then ifconfig; else echo "ifconfig is missing from the machine. skipping..."; fi;
if [ -x "$(command -v ip)" ]; then ip addr; else echo "ip is missing from the machine. skipping..."; fi;
if [ -x "$(command -v netstat)" ]; then $cmd | awk '{print $NF}' | grep -v '[[:lower:]]' | sort | uniq -c; else echo "netstat is missing from the machine. skipping..."; fi;
Dependenciesrun with sh
Description
Check if arp command exists on the machine
Check Prereq Commands
if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;
System Network Configuration Discovery (TrickBot Style)
windows
command_prompt
—
—
—
Identify network configuration information as seen by Trickbot and described here https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/
Upon successful execution, cmd.exe will spawn ipconfig /all, net config workstation, net view /all /domain, nltest /domain_trusts. Output will be via stdout.
Attack Commandsrun with command_prompt
ipconfig /all
net config workstation
net view /all /domain
nltest /domain_trusts
GUIDdafaf052-5508-402d-bf77-51e0700c02e2
05
List Open Egress Ports
windows
powershell
—
1
Yes
This is to test for what ports are open outbound. The technique used was taken from the following blog:
https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/
Upon successful execution, powershell will read top-128.txt (ports) and contact each port to confirm if open or not. Output will be to Desktop\open-ports.txt.
Inputs
Name
Description
Type
Default Value
port_file
The path to a text file containing ports to be scanned, one port per line. The default list uses the top 128 ports as defined by Nmap.
Adfind - Enumerate Active Directory Subnet Objects
windows
command_prompt
—
1
—
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Inputs
Name
Description
Type
Default Value
optional_args
Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.
"This will test if the macOS firewall is enabled and/or show what rules are configured. Must be run with elevated privileges. Upon successful execution, these commands will output various information about the firewall configuration, including status and specific port/protocol blocks or allows.
Using defaults, additional arguments can be added to see filtered details, such as globalstate for global configuration (\"Is it on or off?\"), firewall for common application allow rules, and explicitauths for specific rules configured by the user.
Using socketfilterfw, flags such as --getglobalstate or --listapps can be used for similar filtering. At least one flag is required to send parseable output to standard out.
Attack Commandsrun with bashelevation required (root or admin)
Identify System domain dns controller on an endpoint using nslookup ldap query. This tool is being abused by qakbot malware to gather information on the domain
controller of the targeted or compromised host. reference https://securelist.com/qakbot-technical-analysis/103931/
Uses C# P/Invoke to call GetIpAddrTable from iphlpapi.dll to enumerate all IPv4
addresses bound to local interfaces. Adversaries use this API to discover network
configuration and identify multi-homed hosts for lateral movement or pivoting. Used by
Turla in ApolloShadow malware.
Reference: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/
Attack Commandsrun with powershell
Add-Type -TypeDefinition @'
using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential)]
public struct MIB_IPADDRTABLE
{
public uint dwNumEntries;
public MIB_IPADDRROW table; // first row only
}
[StructLayout(LayoutKind.Sequential)]
public struct MIB_IPADDRROW
{
public uint dwAddr;
public uint dwIndex;
public uint dwMask;
public uint dwBCastAddr;
public uint dwReasmSize;
public ushort unused1;
public ushort wType;
}
public class IpEnumeration{
[DllImport("iphlpapi.dll", SetLastError = true)]
static extern uint GetIpAddrTable(IntPtr pIpAddrTable, ref int pdwSize, bool bOrder);
public static void getIPs(){
int size = 0;
GetIpAddrTable(IntPtr.Zero, ref size, false);
IntPtr buffer = Marshal.AllocHGlobal(size);
try {
GetIpAddrTable(buffer, ref size, false);
var table = Marshal.PtrToStructure<MIB_IPADDRTABLE>(buffer);
int rowSize = Marshal.SizeOf<MIB_IPADDRROW>();
for (int i = 0; i < table.dwNumEntries; i++){
IntPtr rowPtr = buffer + 4 + (i * rowSize);
var row = Marshal.PtrToStructure<MIB_IPADDRROW>(rowPtr);
Console.WriteLine(new System.Net.IPAddress(row.dwAddr));
}
} finally {
Marshal.FreeHGlobal(buffer);
}
}
}
'@
[IpEnumeration]::getIPs()
frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
2021-12-07
2025-10-18
0e4164da-94bc-450d-a7be-a4b176179f1f
Splunk
The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...)
Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
2023-02-09
2024-08-01
43311e65-84d8-42a5-b3d4-c94d9b67038f
Splunk
The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)
The following analytic detects the use of PowerShell's Invoke-RestMethod cmdlet to collect geolocation data from ipinfo.io or IP address information from api.ipify.org. (...)
The following analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. (...)