Techniques › T1049
T1049 System Network Connections Discovery
discovery — ESXi, IaaS, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
6
analytics
9
Sigma rules tagged attack.t1049
1
KEV CVEs mapped here
<p>Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.</p><p>An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate. Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services.</p><p>Utilities and commands that acquire this information include netstat, "net use," and "net session" with Net. In Mac and Linux, netstat and <code>lsof</code> can be used to list current connections. <code>who -a</code> and <code>w</code> can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and Network Device CLI may be used (e.g. <code>show ip sockets</code>, <code>show tcp brief</code>). On ESXi servers, the command
esxi network ip connection list can be used to list active network connections.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2022-41328 | Fortinet FortiOS | secondary impact | Mapped | 2023-03-14 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0320 Detection of System Network Connections Discovery Across Platforms v1.0
AN0903 WindowsDetects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.Tunable:
SuspiciousParentProcessesTimeWindowCommandPatternListAN0904 LinuxDetects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.Tunable:UtilityNameListUserContextScopeExecutionFrequencyThresholdAN0905 macOSDetects shell-based enumeration of active connections usingnetstat,lsof -i, or AppleScript-based system discovery.Tunable:ShellCommandWatchlistTerminalBinaryDenylistAN0906 ESXiDetects shell or API usage ofesxcli network ip connection listornetstatto enumerate ESXi host connections.Tunable:ExecutionOriginCheckExpectedAdminAccessWindowAN0907 Network DevicesDetects interactive or automated use of CLI commands likeshow ip sockets,show tcp brief, or SNMP queries for active sessions on routers/switches.Tunable:CommandPatternListPrivilegedUserCheckAN0908 IaaSDetects enumeration of cloud network interfaces, VPCs, subnets, or peer connections using CLI or SDKs (e.g., AWS CLI, Azure CLI, GCloud CLI).Tunable:ServicePrincipalAllowlistBurstQueryThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1049
Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)
· 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Detects execution of "Net.EXE".
Author: frack113
· 2021-12-10 (modified 2023-02-21) · logsource: product=windows category=process_creation · 1c67a717-32ba-409b-a45d-0fb704a73a81
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Author: Daniil Yugoslavskiy, oscd.community
· 2020-10-19 (modified 2023-01-17) · logsource: product=linux category=process_creation · 4c519226-f0cd-4471-bd2f-6fbb2bb68a79
Detects usage of system utilities to discover system network connections
Author: Andreas Braathen (mnemonic.io)
· 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: Daniil Yugoslavskiy, oscd.community
· 2020-10-19 (modified 2022-12-28) · logsource: product=macos category=process_creation · 9a7a0393-2144-4626-9bf1-7c2f5a7321db
Detects usage of system utilities to discover system network connections
Author: frack113
· 2021-12-10 (modified 2022-12-02) · logsource: product=windows category=ps_module · aff815cc-e400-4bf0-a47a-5d8a2407d4e1
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Author: frack113
· 2021-12-10 (modified 2023-02-14) · logsource: product=windows category=process_creation · b2317cfa-4a47-4ead-b3ff-297438c0bc2d
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Author: frack113
· 2021-12-10 (modified 2023-10-27) · logsource: product=windows category=ps_classic_start · b366adb4-d63d-422d-8a2c-186463b5ded0
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.