tfMITRE ATT&CK technique

System Network Connections Discovery T1049

Tactic: Discovery
Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version: 2.5
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: Praetorian; Austin Clark, @c2defense

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 5%

Threat groups95th percentile · 95% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 9%

Campaigns91st percentile · 91% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 6%

Tools & malware94th percentile · 94% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 15%

Detection rules85th percentile · 85% of ATT&CK techniques have this many detection rules written or fewer.

System Network Connections Discovery MITRE reference T1049

Top 5%of all ATT&CK techniques for number of groups

32 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Velvet AntG1047 ↗

Has enumerated existing network connections on victim devices.1

created 2025-03-141 reference

INC RansomG1032 ↗

Has used RDP to test network connections.1

created 2024-06-061 referenceaka GOLD IONIC

APT5G1023 ↗

Has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.1

created 2024-02-051 referenceaka Mulberry Typhoon

ToddyCatG1022 ↗

Has used netstat -anop tcp to discover TCP connections to compromised hosts.1

created 2024-01-031 reference

Volt TyphoonG1017 ↗

Has used netstat -ano on compromised hosts to enumerate network connections.1 2

created 2023-07-272 referencesaka BRONZE SILHOUETTE

FIN13G1016 ↗

Has used netstat and other net commands for network reconnaissance efforts.1

created 2023-07-271 referenceaka Elephant Beetle

All 32 groups for this technique · 6 newest in this preview

5 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Anthropic AI-orchestrated CampaignC0062 ↗

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to map internal network architecture and access relationships.1

2025

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries identified network connections utilizing netstat -nao and netstat -r.1

2025

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net session, net use, and netstat commands as part of their advanced reconnaissance.1

2019–2022

FunnyDreamC0007 ↗

During FunnyDream, the threat actors used netstat to discover network connections on remote systems.1

2018–2020

Operation WocaoC0014 ↗

During Operation Wocao, threat actors collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.1

2017–2019

All 5 campaigns for this technique

61 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TeamPCP Cloud StealerS9041 ↗

Can search compromised systems for webhook URLs connecting to Slack and Discord.1

created 2026-07-01MALWAREcarried by 1 group

PUBLOADS1228 ↗

Has used several commands executed in sequence via cmd in a short interval to gather information on network connections.1

created 2025-08-04MALWAREcarried by 1 group

FRPS1144 ↗

Can use a dashboard and U/I to display the status of connections from the FRP client and server.1

created 2024-07-10TOOLcarried by 3 groups

LunarWebS1141 ↗

Can enumerate system network connections.1

created 2024-06-26MALWAREcarried by 1 group

PacuS1091 ↗

Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.1

created 2023-09-28TOOL

SardonicS1085 ↗

Has the ability to execute the netstat command.1

created 2023-09-05MALWAREcarried by 1 group

All 61 software entries for this technique · 6 newest in this preview

Offense vs defense T1049

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 5Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 8

first rule: 2019 Q1 · 5 of 5 campaigns plotted

System Network Connections Discovery detection strategy DET0320

MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of System Network Connections Discovery Across Platforms

Enterprise

6 platforms

AN0903 · Windows

Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SuspiciousParentProcesses	Non-standard binaries launching PowerShell or netstat (e.g., winword.exe spawning powershell.exe).
TimeWindow	Correlates discovery behavior before lateral movement or credential access.
CommandPatternList	Regex or keyword patterns to match discovery utilities (e.g., `netstat`, `Get-NetTCPConnection`).

AN0904 · Linux

Detects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	linux:cli	command logging

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UtilityNameList	List of binaries used for discovery (e.g., netstat, ss, lsof).
UserContextScope	Limit detection to non-administrative or service accounts performing enumeration.
ExecutionFrequencyThreshold	Unusual number of executions within a short time window.

AN0905 · macOS

Detects shell-based enumeration of active connections using netstat, lsof -i, or AppleScript-based system discovery.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ShellCommandWatchlist	Matches terminal commands like `lsof -i`, `netstat`, or scripts issued via Automator or AppleScript.
TerminalBinaryDenylist	Tracks execution of networking discovery tools by apps outside Terminal.app or iTerm.

AN0906 · ESXi

Detects shell or API usage of esxcli network ip connection list or netstat to enumerate ESXi host connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:hostd	command log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutionOriginCheck	Detect commands executed outside normal management interfaces (e.g., SSH or root shell).
ExpectedAdminAccessWindow	Timeframe when host connection audits are expected (e.g., maintenance windows).

AN0907 · Network Devices

Detects interactive or automated use of CLI commands like show ip sockets, show tcp brief, or SNMP queries for active sessions on routers/switches.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	snmp:trap	management queries
Command ExecutionDC0064	networkdevice:cli	command logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandPatternList	Monitors for known socket/session query strings.
PrivilegedUserCheck	Restrict detections to non-admin roles executing advanced queries.

AN0908 · IaaS

Detects enumeration of cloud network interfaces, VPCs, subnets, or peer connections using CLI or SDKs (e.g., AWS CLI, Azure CLI, GCloud CLI).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	AWS:CloudTrail	Describe* or List* API calls
Network Traffic ContentDC0085	azure:activity	networkInsightsLogs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServicePrincipalAllowlist	Allow certain automation roles to perform discovery during provisioning.
BurstQueryThreshold	Unusual number of Describe* or List* network API calls in a short timeframe.

1 analytic

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

Tests7ExecutorsPowerShell 3 · sh 2 · cmd 1 · bash 1Need elevation1 of 7Have prerequisites2Have cleanup0Platformswindows, linux, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 System Network Connections Discovery windows cmd — — —

Get a listing of network connections. Upon successful execution, cmd.exe will execute netstat, net use and net sessions. net sessions requires elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.

Attack command

netstat -ano
net use
net sessions 2>nul

GUID4d723c78-b1b8-46e0-8b9b-70c84f951a19

02 System Network Connections Discovery with PowerShell windows PowerShell — — —

Get a listing of network connections. Upon successful execution, powershell.exe will execute get-NetTCPConnection. Results will output via stdout.

Attack command

Get-NetTCPConnection

GUID60af6073-dca3-4ac1-b789-cc23af91c3a0

03 System Network Connections Discovery via PowerShell (Process Mapping) windows PowerShell — — —

Enumerate TCP connections and map to owning process names via PowerShell.

Attack command

Get-NetTCPConnection | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  [pscustomobject]@{
    Local   = "$($_.LocalAddress):$($_.LocalPort)"
    Remote  = "$($_.RemoteAddress):$($_.RemotePort)"
    State   = $_.State
    PID     = $_.OwningProcess
    Process = if ($p) { $p.ProcessName } else { $null }
  }
} | Sort-Object State,Process | Format-Table -AutoSize

GUIDf9527516-fc7e-4f89-8654-2d71bf349a7b

04 System Network Connections Discovery via ss or lsof (Linux/MacOS) linux, macos bash — — —

List active TCP/UDP network connections using ss, with lsof as a fallback when ss is unavailable. Serves as an alternative to the netstat-based test.

Attack command

if command -v ss >/dev/null 2>&1; then ss -antp 2>/dev/null || ss -ant; ss -aunp 2>/dev/null || true; else lsof -i -nP 2>/dev/null || true; fi

GUID446ca1b5-9766-405f-bb54-7781e4855d24

05 System Network Connections Discovery FreeBSD, Linux & MacOS linux, macos sh — 1 —

Get a listing of network connections. Upon successful execution, sh will execute netstat and who -a. Results will output via stdout.

Attack command

netstat
who -a

Prerequisite

Check if netstat command exists on the machine

Check

if [ -x "$(command -v netstat)" ]; then exit 0; else exit 1; fi;

Satisfy

echo "Install netstat on the machine."; exit 1;

GUID26643ff5-7b8f-4260-a482-53c102513757

06 System Network Connections Discovery via sockstat (Linux, FreeBSD) linux sh — — —

Enumerate IPv4/IPv6 network endpoints on FreeBSD using sockstat.

Attack command

sockstat -4
sockstat -6 2>/dev/null || true
sockstat -l 2>/dev/null || true

GUIDc0af3bc1-6332-4c34-a882-1431181d4638

07 System Discovery using SharpView windows PowerShell Required 1 —

Get a listing of network connections, domains, domain users, and etc. sharpview.exe located in the bin folder, an opensource red-team tool. Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.

Input arguments

Name	Type	Default	Description
syntax	string	"Invoke-ACLScanner", "Invoke-Kerberoast", "Find-DomainShare"	Arguements method used along with SharpView to get listing of network connections, domains, domain users, and etc.
SharpView	path	PathToAtomicsFolder\..\ExternalPayloads\SharpView.exe	Path of the executable opensource redteam tool used for the performing this atomic.
SharpView_url	url	https://github.com/tevora-threat/SharpView/blob/b60456286b41bb055ee7bc2a14d645410cca9b74/Compiled/SharpView.exe?raw=true	sharpview download URL

Attack command

$syntaxList = #{syntax}
foreach ($syntax in $syntaxList) {
#{SharpView} $syntax -}

Prerequisite

Sharpview.exe must exist on disk at specified location (#{SharpView})

Check

if (Test-Path "#{SharpView}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{SharpView}") -ErrorAction ignore | Out-Null
Invoke-WebRequest #{SharpView_url} -OutFile "#{SharpView}"

GUIDca4e41f6-b4e1-4e38-ac2f-ce5addeb8a7d

Tests from Atomic Red Team (MIT licence) · technique definition

System Network Connections Discovery detections T1049

17 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 15%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs