kevmap

Techniques › T1018

T1018 Remote System Discovery

discovery — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
5
analytics
17
Sigma rules tagged attack.t1018
2
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, esxcli network diag ping.</p><p>Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment.</p><p>Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

CVEVendor / productMapping typeStateAdded
CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways secondary impact Mapped2025-01-08
CVE-2023-38035Ivanti Sentry secondary impact Mapped2023-08-22

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1018

Macos Remote System Discovery informationaltest
Author: Alejandro Ortuno, oscd.community · 2020-10-22 (modified 2021-11-27) · logsource: product=macos category=process_creation · 10227522-8429-47e6-a301-f2b2d014e7ad
Detects the enumeration of other remote systems.
Techniques: T1018
Linux Remote System Discovery lowtest
Author: Alejandro Ortuno, oscd.community · 2020-10-22 (modified 2021-11-27) · logsource: product=linux category=process_creation · 11063ec2-de63-4153-935e-b1a8b9e616f1
Detects the enumeration of other remote systems.
Techniques: T1018
Net.EXE Execution lowtest
Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Detects execution of "Net.EXE".
Techniques: T1007T1049T1018T1135T1201T1069.001T1069.002T1087.001T1087.002T1021.002
DirectorySearcher Powershell Exploitation mediumtest
Author: frack113 · 2022-02-12 · logsource: product=windows category=ps_script · 1f6399cf-2c80-4924-ace1-6fcff3393480
Enumerates Active Directory to determine computers that are joined to the domain
Techniques: T1018
PUA - Adidnsdump Execution lowtest
Author: frack113 · 2022-01-01 (modified 2023-02-21) · logsource: product=windows category=process_creation · 26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160
This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed, Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP
Techniques: T1018
Active Directory Computers Enumeration With Get-AdComputer lowtest
Author: frack113 · 2022-03-17 (modified 2023-07-08) · logsource: product=windows category=ps_script · 36bed6b2-e9a0-4fff-beeb-413a92b86138
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Techniques: T1018T1087.002
Webshell Hacking Activity Patterns hightest
Author: Florian Roth (Nextron Systems) · 2022-03-17 (modified 2023-11-09) · logsource: product=windows category=process_creation · 4ebc877f-4612-45cb-b3a5-8e3834db36c9
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system
Techniques: T1505.003T1018T1033T1087
Share And Session Enumeration Using Net.EXE lowstable
Author: Endgame, JHasenbusch (ported for oscd.community) · 2018-10-30 (modified 2023-02-21) · logsource: product=windows category=process_creation · 62510e69-616b-4078-b371-847da438cc03
Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.
Techniques: T1018
HackTool - NetExec Execution highexperimental
Author: Chirag Damani · 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d
Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
Techniques: T1018T1021
Nltest.EXE Execution lowtest
Author: Arun Chauhan · 2023-02-03 · logsource: product=windows category=process_creation · 903076ff-f442-475a-b667-4f246bcc203b
Detects nltest commands that can be used for information discovery
Techniques: T1016T1018T1482
Cisco Discovery lowtest
Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Techniques: T1083T1201T1057T1018T1082T1016T1049T1033T1124
PUA - AdFind Suspicious Execution hightest
Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community · 2021-02-02 (modified 2025-10-24) · logsource: product=windows category=process_creation · 9a132afa-654e-11eb-ae93-0242ac130002
Detects AdFind execution with common flags seen used during attacks
Techniques: T1018T1087.002T1482T1069.002
Webshell Detection With Command Line Keywords hightest
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson · 2017-01-01 (modified 2026-07-14) · logsource: product=windows category=process_creation · bed2a484-9348-4143-8a8a-b801c979301c
Detects certain command line parameters often used during reconnaissance activity via web shells
Techniques: T1505.003T1018T1033T1087
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock mediumexperimental
Author: frack113 · 2025-03-05 · logsource: product=windows category=ps_script · cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
Techniques: T1018T1558T1589.002
Renamed AdFind Execution hightest
Author: Florian Roth (Nextron Systems) · 2022-08-21 (modified 2025-02-26) · logsource: product=windows category=process_creation · df55196f-f105-44d3-a675-e9dfb6cc2f2b
Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.
Techniques: T1018T1087.002T1482T1069.002
Suspicious Scan Loop Network mediumtest
Author: frack113 · 2022-03-12 · logsource: product=windows category=process_creation · f8ad2e2c-40b6-4117-84d7-20b89896ab23
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system
Techniques: T1059T1018
Chopper Webshell Process Pattern hightest
Author: Florian Roth (Nextron Systems), MSTI (query) · 2022-10-01 · logsource: product=windows category=process_creation · fa3c117a-bc0d-416e-a31b-0c0e80653efb
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Techniques: T1505.003T1018T1033T1087