Daniel Stepanic, Elastic; RedHuntLabs, @redhuntlabs; Austin Clark, @c2defense
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, esxcli network diag ping.
Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment.
Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).[1][2]
Top 3%of all ATT&CK techniques for number of groups
41 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During C0015, the threat actors used the commands net view /all /domain and ping to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.1
During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.1
2018–2020
All 9 campaigns for this technique · 6 newest in this preview
54 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Remote System Discovery detection strategy DET0574
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Remote System Enumeration Behavior
Enterprise
5 platforms
AN1583 · Windows
Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CommandList
Device-specific recon commands to monitor based on make/model
PrivLevel
Trigger detection for privilege escalation prior to recon commands
1 analytic
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
TypeTTPCoverageLowSubmitted2013
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include
Tests23Executorscommand_prompt 9 · powershell 7 · sh 6 · bash 1Need elevation2 of 23Have prerequisites9Have cleanup2Platformswindows, linux, macos
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Remote System Discovery - net
windows
command_prompt
—
—
—
Identify remote systems with net.exe.
Upon successful execution, cmd.exe will execute net.exe view and display results of local systems on the network that have file and print sharing enabled.
Attack Commandsrun with command_prompt
net view /domain
net view
GUID85321a9c-897f-4a60-9f20-29788e50bccd
02
Remote System Discovery - net group Domain Computers
windows
command_prompt
—
—
—
Identify remote systems with net.exe querying the Active Directory Domain Computers group.
Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.
Attack Commandsrun with command_prompt
net group "Domain Computers" /domain
GUIDf1bf6c8f-9016-4edf-aff9-80b65f5d711f
03
Remote System Discovery - nltest
windows
command_prompt
—
—
—
Identify domain controllers for specified domain.
Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.
Inputs
Name
Description
Type
Default Value
target_domain
Domain to query for domain controllers
string
%userdnsdomain%
Attack Commandsrun with command_prompt
nltest.exe /dclist:#{target_domain}
GUID52ab5108-3f6f-42fb-8ba3-73bc054f22c8
04
Remote System Discovery - ping sweep
windows
command_prompt
—
—
—
Identify remote systems via ping sweep.
Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.
Inputs
Name
Description
Type
Default Value
subnet
Subnet used for ping sweep.
string
192.168.1
stop_host
Last octet ending value for ping sweep.
string
254
start_host
Last octet starting value for ping sweep.
string
1
Attack Commandsrun with command_prompt
for /l %i in (#{start_host},1,#{stop_host}) do ping -n 1 -w 100 #{subnet}.%i
GUID6db1f57f-d1d5-4223-8a66-55c9c65a9592
05
Remote System Discovery - arp
windows
command_prompt
—
—
—
Identify remote systems via arp.
Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.
Attack Commandsrun with command_prompt
arp -a
GUID2d5a61f5-0447-4be4-944a-1f8530ed6574
06
Remote System Discovery - arp nix
linux, macos
sh
—
1
—
Identify remote systems via arp.
Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.
Attack Commandsrun with sh
arp -a | grep -v '^?'
Dependenciesrun with sh
Description
Check if arp command exists on the machine
Check Prereq Commands
if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;
Identify remote systems via ping sweep.
Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.
Inputs
Name
Description
Type
Default Value
subnet
Subnet used for ping sweep.
string
192.168.1
stop_host
Subnet used for ping sweep.
string
254
start_host
Subnet used for ping sweep.
string
1
Attack Commandsrun with sh
for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip; [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done
GUID96db2632-8417-4dbb-b8bb-a8b92ba391de
08
Remote System Discovery - nslookup
windows
powershell
Required
—
—
Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.
Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.
Attack Commandsrun with powershellelevation required (root or admin)
This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks
Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.
Successful execution of this test will list dns zones in the terminal.
Adfind - Enumerate Active Directory Computer Objects
windows
command_prompt
—
1
—
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Inputs
Name
Description
Type
Default Value
optional_args
Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.
Adfind - Enumerate Active Directory Domain Controller Objects
windows
command_prompt
—
1
—
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
Inputs
Name
Description
Type
Default Value
optional_args
Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces.
Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment.
Attack Commandsrun with sh
ip neighbour show
Dependenciesrun with sh
Description
Check if ip command exists on the machine
Check Prereq Commands
if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
Get Prereq Commands
apt-get install iproute2 -y
GUID158bd4dd-6359-40ab-b13c-285b9ef6fa25
13
Remote System Discovery - ip route
linux
sh
—
1
—
Use the ip route command to display the kernels routing tables.
Attack Commandsrun with sh
ip route show
Dependenciesrun with sh
Description
Check if ip command exists on the machine
Check Prereq Commands
if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
Get Prereq Commands
apt-get install iproute2 -y
GUID1a4ebe70-31d0-417b-ade2-ef4cb3e7d0e1
14
Remote System Discovery - netstat
linux
sh
—
—
—
Use the netstat command to display the kernels routing tables.
Attack Commandsrun with sh
netstat -r | grep default
GUIDd2791d72-b67f-4615-814f-ec824a91f514
15
Remote System Discovery - ip tcp_metrics
linux
sh
—
1
—
Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses.
Attack Commandsrun with sh
ip tcp_metrics show |grep --invert-match "^127\."
Dependenciesrun with sh
Description
Check if ip command exists on the machine
Check Prereq Commands
if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
Get Prereq Commands
apt-get install iproute2 -y
GUID6c2da894-0b57-43cb-87af-46ea3b501388
16
Enumerate domain computers within Active Directory using DirectorySearcher
windows
powershell
—
1
—
This test is a Powershell script that enumerates Active Directory to determine computers that are joined to the domain.
This test is designed to mimic how SessionGopher can determine the additional systems within a domain, which has been used before by threat actors to aid in lateral movement.
Reference: Head Fake: Tackling Disruptive Ransomware Attacks.
Upon successful execution, this test will output the names of the computers that reside on the domain to the console window.
write-host "This PC must be manually added to a domain."
GUID962a6017-1c09-45a6-880b-adc9c57cb22e
17
Enumerate Active Directory Computers with Get-AdComputer
windows
powershell
—
—
—
The following Atomic test will utilize Get-AdComputer to enumerate Computers within Active Directory.
Upon successful execution a listing of Computers will output with their paths in AD.
Reference: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/main/docset/winserver2022-ps/activedirectory/Get-ADComputer.md
Attack Commandsrun with powershell
Get-AdComputer -Filter *
GUID97e89d9e-e3f5-41b5-a90f-1e0825df0fdf
18
Enumerate Active Directory Computers with ADSISearcher
windows
powershell
—
—
—
The following Atomic test will utilize ADSISearcher to enumerate computers within Active Directory.
Upon successful execution a listing of computers will output with their paths in AD.
Reference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
Utilizing PowerView, run Get-DomainController to identify the Domain Controller. Upon execution, information about the domain controller within the domain will be displayed.
The following Atomic test will utilize get-wmiobject to enumerate Active Directory for Domain Controllers.
Upon successful execution a listing of Systems from AD will output with their paths.
Reference: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
Remote System Discovery - net group Domain Controller
windows
command_prompt
—
—
—
Identify remote systems with net.exe querying the Active Directory Domain Controller.
Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Controller" in the domain. Output will be via stdout.
Attack Commandsrun with command_prompt
net group /domain "Domain controllers"
GUID5843529a-5056-4bc1-9c13-a311e2af4ca0
22
Enumerate Remote Hosts with Netscan
windows
powershell
—
1
Yes
This test uses Netscan to identify remote hosts in a specified network range.
SSH metadata files (authorized_keys, known_hosts, config) can be used to
discover remote systems and trust relationships. known_hosts
reveals previously connected servers, config exposes host aliases and jump
proxies, and authorized_keys shows which public keys are trusted for login.
Inputs
Name
Description
Type
Default Value
filename
SSH metadata file to search for
string
known_hosts
output_file
File to write results to
path
/tmp/ssh_enum.txt
search_path
Directory to search under
string
/
Attack Commandsrun with bash
find #{search_path} -name "#{filename}" -type f 2>/dev/null | while read -r file; do echo "=== $file ===" >> #{output_file}; cat "$file" >> #{output_file}; done
The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)
The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)
The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...)
The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)
The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. (...)
The following analytic detects the execution of `powershell.exe` with the `Get-DomainController` command, which is used to discover remote systems within a Windows domain. (...)
The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter. (...)
The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). (...)
The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell scripts to query Active Directory for domain computers. (...)
The following analytic detects the execution of `dsquery.exe` with the `computer` argument, which is used to discover remote systems within a domain. (...)
The following analytic identifies the execution of `adfind.exe` standalone or with specific command-line arguments related to Active Directory queries. (...)
Jose Hernandez, Bhavin Patel, Nasreddine Bencherchali, Splunk
2020-12-17
2026-10-02
bd3b0187-189b-46c0-be45-f52da2bae67f
Splunk
The following analytic detects the use of the Get-ADComputer cmdlet with parameters indicating a search for Windows endpoints with Kerberos Unconstrained Delegation. (...)