TA2541G1018 ↗
Has run scripts to check internet connectivity from compromised hosts. 1
tfMITRE ATT&CK sub-technique
Internet Connection Discovery T1016.001
sub-technique of T1016 System Network Configuration Discovery
- Tactic
- Discovery
- Platforms
- Windows, Linux, macOS, ESXi
- Version
- 1.2
- Created
- 17 March 2021
- Last modified
- 24 October 2025
- Contributor
- Christopher Peacock
Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
11
Threat groupsTop 17%
Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.13
Tools & malwareTop 23%
Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Internet Connection Discovery MITRE reference T1016.001
Top 17%of all ATT&CK techniques for number of groups
11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Volt TyphoonG1017 ↗
FIN13G1016 ↗
Has used Ping and tracert for network reconnaissance efforts.1
HAFNIUMG0125 ↗
Has checked for network connectivity from a compromised host using ping, including attempts to contact google[.]com.1
HEXANEG1001 ↗
Has used tools including BITSAdmin to test internet connectivity from compromised hosts.1
FIN8G0061 ↗
Has used the Ping command to check connectivity to actor-controlled C2 servers.1
All 11 groups for this technique · 6 newest in this preview
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.1
Operation WocaoC0014 ↗
During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.1
All 2 campaigns for this technique
13 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
HavocS1229 ↗
The Havoc demon can check for a connection to the C2 server from the target machine.1
PUBLOADS1228 ↗
Has identified internet connectivity details through commands such as tracert -h 5 -4 google.com and curl http://myip.ipip.net.1
NKAbuseS1107 ↗
Utilizes external services such as ifconfig.me to identify the victim machine's IP address.1
DarkTortillaS1066 ↗
Can check for internet connectivity by issuing HTTP GET requests.1
Woody RATS1065 ↗
Can make Ping GET HTTP requests to its C2 server at regular intervals for network connectivity checks.1
SUGARUSHS1049 ↗
Has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.1
All 13 software entries for this technique · 6 newest in this preview
Offense vs defense T1016.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2021 Q4 · 2 of 2 campaigns plottedInternet Connection Discovery detection strategy DET0357
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Internet Connection Discovery
4 platforms
AN1015 · Windows
Execution of utilities (e.g., ping, tracert, Test-NetConnection) or scripted methods to test Internet connectivity by interacting with external IPs/domains.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Network Connection CreationDC0082 | WinEventLog:Security | EventCode=5156, 5157 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DestinationIP | Tunable external IP ranges or domains used to verify Internet access (e.g., 8.8.8.8, example.com) |
| TimeWindow | Cluster rapid test connections with command execution in < 60 seconds |
| UserContext | Filter out known admin/script contexts to reduce false positives |
AN1016 · Linux
Execution of ping, traceroute, or curl/wget against public IPs/domains to verify Internet reachability.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | execve |
| Network Connection CreationDC0082 | linux:syslog | network |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DomainPatterns | Regex for common test domains like example.com, google.com |
| ProtocolType | Adjust focus to ICMP, HTTP, or mixed protocol testing |
AN1017 · macOS
Execution of ping, traceroute, or network utility tools to external destinations; may include scutil or system_profiler.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutionFrequency | Rare use of ICMP utilities may be tuned based on user/host baselines |
| EnrichmentLevel | Tune data joins with parent process and user activity context |
AN1018 · ESXi
Execution of ping, vmkping, or curl from shell or through automation jobs/scripts to verify Internet egress.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | esxi:shell | None |
| Process CreationDC0032 | esxi:hostd | process |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SSHSessionOrigin | Distinguish external SSH sessions from internal admin maintenance |
| TargetIP | Egress test destination may be filtered to known CDNs/test nodes |
Tests5ExecutorsPowerShell 3 · cmd 1 · bash 1Need elevation0 of 5Have prerequisites0Have cleanup0Platformswindows, macos, linux
Tests from Atomic Red Team (MIT licence) · technique definition