attack.t1016

Suspicious Network Connection to IP Lookup Service APIs

Dec 1, 2023 · attack.discovery attack.t1016 ·

Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.

Nltest.EXE Execution

Dec 1, 2023 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

Potential Recon Activity Via Nltest.EXE

Dec 1, 2023 · attack.discovery attack.t1016 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

Potential Pikabot Discovery Activity - Suspicious Process Created By Rundll32.EXE

Nov 6, 2023 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging_threats ·

Share on:

Detects the execution of rundll32 that leads to system discovery activity, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Suspicious Network Command

Oct 17, 2023 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Potential Network Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1016 ·

Share on:

Detects network enumeration performed on AWS.

System Network Discovery - Linux

Apr 5, 2023 · attack.discovery attack.t1016 ·

Share on:

Detects enumeration of local network configuration

Suspicious Firewall Configuration Discovery Via Netsh.EXE

Feb 14, 2023 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Nslookup Local

Jan 9, 2023 · attack.discovery attack.t1016 ·

Share on:

Detects use of nslookup to look up the local nameserver as part of host discovery

Cisco Discovery

Jan 4, 2023 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·