attack.t1016

System Network Discovery - macOS

Aug 29, 2024 · attack.discovery attack.t1016 ·

Detects enumeration of local network configuration

Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

Firewall Configuration Discovery Via Netsh.EXE

Aug 12, 2024 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Nltest.EXE Execution

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1018 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

OpenCanary - SNMP OID Request

Aug 12, 2024 · attack.discovery attack.lateral-movement attack.t1016 attack.t1021 ·

Share on:

Detects instances where an SNMP service on an OpenCanary node has had an OID request.

Potential Pikabot Discovery Activity

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging-threats ·

Share on:

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Potential Recon Activity Via Nltest.EXE

Aug 12, 2024 · attack.discovery attack.t1016 attack.t1482 ·

Share on:

Detects nltest commands that can be used for information discovery

Suspicious Network Command

Aug 12, 2024 · attack.discovery attack.t1016 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Suspicious Network Connection to IP Lookup Service APIs

Aug 12, 2024 · attack.discovery attack.t1016 ·

Share on:

Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.

System Network Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1016 ·

Share on:

Detects enumeration of local network configuration

Potential Network Enumeration on AWS

Apr 21, 2023 · attack.discovery attack.t1016 ·

Share on:

Detects network enumeration performed on AWS.

Nslookup Local

Jan 9, 2023 · attack.discovery attack.t1016 ·

Share on:

Detects use of nslookup to look up the local nameserver as part of host discovery