ESXi, IaaS, Linux, macOS, Network Devices, Windows
Version
2.5
Created
31 May 2017
Last modified
12 May 2026
Contributors
Praetorian; Austin Clark, @c2defense
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.[1][2][3] Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services.
Utilities and commands that acquire this information include netstat, "net use," and "net session" with Net. In Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and Network Device CLI may be used (e.g. show ip sockets, show tcp brief).[4] On ESXi servers, the command esxi network ip connection list can be used to list active network connections.[5]
Threat groups95th percentile · 95% of ATT&CK techniques have fewer threat groups attributed.
5
CampaignsTop 9%
Campaigns91st percentile · 90% of ATT&CK techniques have fewer campaigns recorded.
61
Tools & malwareTop 6%
Tools & malware94th percentile · 94% of ATT&CK techniques have fewer tools implementing them.
17
Detection rulesTop 15%
Detection rules85th percentile · 85% of ATT&CK techniques have fewer detection rules written.
System Network Connections Discovery MITRE reference T1049
Top 5%of all ATT&CK techniques for number of groups
32 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During Operation Wocao, threat actors collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.1
2017–2019
All 5 campaigns for this technique
61 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
System Network Connections Discovery detection strategy DET0320
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of System Network Connections Discovery Across Platforms
Enterprise
6 platforms
AN0903 · Windows
Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ServicePrincipalAllowlist
Allow certain automation roles to perform discovery during provisioning.
BurstQueryThreshold
Unusual number of Describe* or List* network API calls in a short timeframe.
1 analytic
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
TypeTTPCoverageLowSubmitted2013
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include
Tests7Executorspowershell 3 · sh 2 · command_prompt 1 · bash 1Need elevation1 of 7Have prerequisites2Have cleanup0Platformswindows, linux, macos
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
System Network Connections Discovery
windows
command_prompt
—
—
—
Get a listing of network connections.
Upon successful execution, cmd.exe will execute netstat, net use and net sessions. net sessions requires
elevated privileges; on standard user accounts this command may not return results. Results will output via stdout.
Attack Commandsrun with command_prompt
netstat -ano
net use
net sessions 2>nul
GUID0940a971-809a-48f1-9c4d-b1d785e96ee5
02
System Network Connections Discovery with PowerShell
windows
powershell
—
—
—
Get a listing of network connections.
Upon successful execution, powershell.exe will execute get-NetTCPConnection. Results will output via stdout.
Attack Commandsrun with powershell
Get-NetTCPConnection
GUIDf069f0f1-baad-4831-aa2b-eddac4baac4a
03
System Network Connections Discovery via PowerShell (Process Mapping)
windows
powershell
—
—
—
Enumerate TCP connections and map to owning process names via PowerShell.
Get a listing of network connections, domains, domain users, and etc.
sharpview.exe located in the bin folder, an opensource red-team tool.
Upon successful execution, cmd.exe will execute sharpview.exe <method>. Results will output via stdout.
Inputs
Name
Description
Type
Default Value
syntax
Arguements method used along with SharpView to get listing of network connections, domains, domain users, and etc.
The following analytic identifies the execution of `powershell.exe` with the `Get-NetTcpConnection` command, which lists current TCP connections on a system. (...)
The following analytic detects the execution of the `Get-NetTcpconnection` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). (...)
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. (...)
The following analytic identifies the execution of `net.exe` with command-line arguments used to list or display information about computer connections. (...)
The following analytic detects the execution of the Windows built-in tool netsh.exe to display the state, configuration, and profile of the host firewall. (...)