System Network Configuration Discovery T1016
Tactic: Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
Events covered
19 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 22 | DNSEvent (DNS query) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Defender-DeviceProcessEvents | any | Process activity |
| ESF | exec | Process Execution |
| ESF | open | File Open |
| ESF | write | File Write |
| Linux-Auditd | Event ID 1101 | USER_ACCT |
| Linux-Auditd | Event ID 1103 | CRED_ACQ |
| Linux-Auditd | Event ID 1105 | USER_START |
| Linux-Auditd | Event ID 1106 | USER_END |
| Linux-Auditd | Event ID 1123 | USER_CMD |
| Linux-Auditd | Event ID 1300 | SYSCALL |
| DNS-Server-Service | Event ID 6004 | The DNS server received a zone transfer request from param1 for a non-existent or non-authoritative zone param2. |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| PowerShell | Event ID 800 | Event ID 800 |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 74 rules share fields, values, and exclusions.
Fields filtered most (65 distinct)
These fields appear most often in rule filters.
Top indicator values (1057 distinct)
These values appear most often in rule predicates.
Exclusions (299 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 16 rules
- Cisco Discovery
- Failed DNS server zone transfer for enumeration purposes
- Firewall Configuration Discovery Via Netsh.EXE
- Firewall configuration enumerated (command)
- Firewall configuration enumerated (PowerShell)
- Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
- Nltest.EXE Execution
- OpenCanary - SNMP OID Request
- Potential Pikabot Discovery Activity
- Potential Recon Activity Via Nltest.EXE
- Scheduled task enumerated
- Suspicious Network Command
- Suspicious Network Connection to IP Lookup Service APIs
- System Network Discovery - Linux
- System Network Discovery - macOS
- Winlogon process contact to C2 - Blacklotus (Sysmon)
Elastic 30 rules
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Deprecated - PowerShell Script with Discovery Capabilities
- Discovery Command Output Written to Suspicious File
- Discovery of Internet Capabilities via Built-in Tools
- DNS Enumeration Detected via Defend for Containers
- DNS Request for IP Lookup Service via Unsigned Binary
- Enumeration Command Spawned via WMIPrvSE
- External IP Address Discovery via a Trusted Program
- External IP Address Discovery via Curl
- External IP Address Discovery via Untrusted Program
- External IP Lookup from Non-Browser Process
- Linux External IP Address Discovery via Curl
- Potential HawkEyes Stealer Infection
- Potential Meterpreter Reverse Shell
- PowerShell Suspicious Discovery Related Windows API Functions
- Remote System Discovery Commands
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious Instance Metadata Service (IMDS) API Request
- Suspicious JetBrains TeamCity Child Process
- Suspicious MS Office Child Process
- Suspicious PDF Reader Child Process
- Suspicious System Commands Executed by Previously Unknown Executable
- System and Network Configuration Check
- System Hosts File Access
- System Network Connections Discovery
- System Public IP Discovery via DNS Query
- Unusual Linux Network Configuration Discovery
- Windows System Network Connections Discovery
- Wireless Credential Dumping using Netsh Command
Splunk 25 rules
- Adfind Commands (PowerShell)
- Adfind Commands (Sysmon)
- Adfind Commands (Windows Event Log)
- Adfind Execution (PowerShell)
- Adfind Execution (Sysmon)
- Adfind Execution (Windows Event Log)
- Cisco IOS XE Reconnaissance Command Activity
- Cisco NVM - Suspicious Network Connection to IP Lookup Service API
- Domain Controller Enumeration via nltest (PowerShell)
- Domain Controller Enumeration via nltest (Sysmon)
- Domain Controller Enumeration via nltest (Windows Event Log)
- Linux Auditd System Network Configuration Discovery
- Linux Enumeration Techniques
- Linux System Network Discovery
- MacOS List Firewall Rules
- Multiple nslookup commands (Sysmon)
- Multiple nslookup commands (Windows Event Log)
- Network Discovery Using Route Windows App
- Nslookup Execution (Windows Event Log)
- Potential System Network Configuration Discovery Activity
- Windows Common Abused Cmd Shell Risk Behavior
- Windows Post Exploitation Risk Behavior
- Windows PowerShell Invoke-RestMethod IP Information Collection
- Windows System Network Config Discovery Display DNS
- Windows WinPEAS PowerShell Script Execution