attack.t1049

Use Get-NetTCPConnection - PowerShell Module
May 15, 2023 · attack.discovery attack.t1049 ·
Share on:
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Read More
Net.exe Execution
Feb 21, 2023 · attack.discovery attack.t1007 attack.t1049 attack.t1018 attack.t1135 attack.t1201 attack.t1069.001 attack.t1069.002 attack.t1087.001 attack.t1087.002 attack.lateral_movement attack.t1021.002 attack.s0039 ·
Share on:
Detects execution of Net.exe, whether suspicious or benign.

Read More
System Network Connections Discovery Via Net.EXE
Feb 21, 2023 · attack.discovery attack.t1049 ·
Share on:
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Read More
HackTool - SharpView Execution
Feb 13, 2023 · attack.discovery attack.t1049 attack.t1069.002 attack.t1482 attack.t1135 attack.t1033 ·
Share on:
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Read More
System Network Connections Discovery - Linux
Jan 17, 2023 · attack.discovery attack.t1049 ·
Share on:
Detects usage of system utilities to discover system network connections

Read More
Cisco Discovery
Jan 4, 2023 · attack.discovery attack.t1083 attack.t1201 attack.t1057 attack.t1018 attack.t1082 attack.t1016 attack.t1049 attack.t1033 attack.t1124 ·
Share on:
Find information about network devices that is not stored in config files

Read More
System Network Connections Discovery - MacOs
Dec 29, 2022 · attack.discovery attack.t1049 ·
Share on:
Detects usage of system utilities to discover system network connections

Read More
Use Get-NetTCPConnection
Dec 27, 2022 · attack.discovery attack.t1049 ·
Share on:
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Read More