attack.t1049

Potential Pikabot Discovery Activity

Dec 1, 2024 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging-threats ·

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

Cisco Discovery

Aug 12, 2024 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·

Share on:

Find information about network devices that is not stored in config files

HackTool - SharpView Execution

Aug 12, 2024 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·

Share on:

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

System Network Connections Discovery - Linux

Aug 12, 2024 · attack.discovery attack.t1049 ·

Share on:

Detects usage of system utilities to discover system network connections

System Network Connections Discovery - MacOs

Aug 12, 2024 · attack.discovery attack.t1049 ·

Share on:

Detects usage of system utilities to discover system network connections

System Network Connections Discovery Via Net.EXE

Aug 12, 2024 · attack.discovery attack.t1049 ·

Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Use Get-NetTCPConnection

Aug 12, 2024 · attack.discovery attack.t1049 ·

Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Use Get-NetTCPConnection - PowerShell Module

Aug 12, 2024 · attack.discovery attack.t1049 ·

Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.