MITRE ATT&CK Tactic(s): Discovery

MITRE ATT&CK Description

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).

Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

Last accessed: May 23, 2022

Total ATT&CK-mapped resources: 2328

ATT&CK-mapped resources for this (sub)technique: 1

Resources mapped to this (sub)technique can be viewed on this page (see also the ATT&CK to D3FEND Mapper tool):

• no defensive relations yet

Last accessed: August 09, 2022

Total ATT&CK-mapped rules: 159

ATT&CK-mapped resources for this (sub)technique: 2

Resources mapped to this (sub)technique can be located in the following files within the repository's analytics folder:

• Quick execution of a series of suspicious commands
• Host Discovery Commands

Last accessed: August 09, 2022

Total ATT&CK-mapped rules: 641

ATT&CK-mapped resources for this (sub)technique: 2

Resources mapped to this (sub)technique can be located in the following files within the repository's rules folder:

• • Unusual Linux System Network Configuration Discovery Unusual Linux System Network Configuration Discovery
• Remote System Discovery Commands)**

Last accessed: August 09, 2022

Total ATT&CK-mapped rules: 2578

ATT&CK-mapped resources for this (sub)technique: 8

Resources mapped to this (sub)technique can be located in the following files within the repository's rules folder:

• apt / Silence.Downloader V3
• linux / process_creation / System Network Discovery - Linux
• macos / process_creation / System Network Discovery - macOS
• network / cisco / aaa / Cisco Discovery
• windows / builtin / security / Correct Execution of Nltest.exe
• windows / process_creation / Recon Activity with NLTEST
• windows / process_creation / Suspicious Netsh Discovery Command
• windows / process_creation / Suspicious Network Command

Last accessed: August 09, 2022

Total ATT&CK-mapped rules: 1624

ATT&CK-mapped resources for this (sub)technique: 3

Resources mapped to this (sub)technique can be located in the following files within the repository's detections folder:

• endpoint / Detect processes used for System Network Configuration Discovery
• endpoint / Linux System Network Discovery
• endpoint / Network Discovery Using Route Windows App

Last accessed: August 10, 2022

Total ATT&CK-mapped tests: 1341

ATT&CK-mapped resources for this (sub)technique: 8

The following unit tests mapped to this (sub)technique can be located in the file here:

• System Network Configuration Discovery on Windows
• List Windows Firewall Rules
• System Network Configuration Discovery
• System Network Configuration Discovery (TrickBot Style)
• List Open Egress Ports
• Adfind - Enumerate Active Directory Subnet Objects
• Qakbot Recon
• List macOS Firewall Rules

Last accessed: August 10, 2022

Total ATT&CK-mapped tests: 70

ATT&CK-mapped resources for this (sub)technique: 1

Resources mapped to this (sub)technique can be located in the following files within this repository:

• Quick execution of a series of suspicious commands: 1 unit tests