Remote System Discovery T1018
Tactic: Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, `esxcli network diag ping`.
Events covered
19 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 5 | Process terminated |
| Sysmon | Event ID 7 | Image loaded |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 4689 | A process has exited. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
| Defender-DeviceEvents | LdapSearch | LDAP search |
| Defender-DeviceInfo | any | Device information |
| Defender-DeviceNetworkEvents | any | Network activity |
| Defender-DeviceNetworkInfo | any | Device network configuration |
| Defender-DeviceProcessEvents | any | Process activity |
| ESF | exec | Process Execution |
| Linux-Auditd | Event ID 1123 | USER_CMD |
| Linux-Auditd | Event ID 1309 | EXECVE |
| Linux-Auditd | Event ID 1327 | PROCTITLE |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 86 rules share fields, values, and exclusions.
Fields filtered most (57 distinct)
These fields appear most often in rule filters.
Top indicator values (530 distinct)
These values appear most often in rule predicates.
Exclusions (65 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 18 rules
- Active Directory Computers Enumeration With Get-AdComputer
- Chopper Webshell Process Pattern
- Cisco Discovery
- DirectorySearcher Powershell Exploitation
- DNS hosts file accessed via network share
- HackTool - NetExec Execution
- Linux Remote System Discovery
- Macos Remote System Discovery
- Net.EXE Execution
- Nltest.EXE Execution
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
- PUA - AdFind Suspicious Execution
- PUA - Adidnsdump Execution
- Renamed AdFind Execution
- Share And Session Enumeration Using Net.EXE
- Suspicious Scan Loop Network
- Webshell Detection With Command Line Keywords
- Webshell Hacking Activity Patterns
Elastic 15 rules
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- DNS Enumeration Detected via Defend for Containers
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- ICMP Timestamp or Information Request from the Internet
- Potential Enumeration via Active Directory Web Service
- Potential Network Scan Executed From Host
- Potential Network Sweep Detected
- Potential Subnet Scanning Activity from Compromised Host
- Remote System Discovery Commands
- Spike in Firewall Denies
- System Hosts File Access
- Windows Network Enumeration
Splunk 42 rules
- Adfind Commands (PowerShell)
- Adfind Commands (Sysmon)
- Adfind Commands (Windows Event Log)
- Adfind Execution (PowerShell)
- Adfind Execution (Sysmon)
- Adfind Execution (Windows Event Log)
- Cisco IOS XE Remote Access Probe Burst
- Cisco Secure Firewall - Blocked Connection
- Cisco Secure Firewall - Repeated Blocked Connections
- Domain Controller Discovery with Nltest
- Domain Controller Discovery with Wmic
- Domain Controller Enumeration via nltest (PowerShell)
- Domain Controller Enumeration via nltest (Sysmon)
- Domain Controller Enumeration via nltest (Windows Event Log)
- FScan.exe Network Scan (Sysmon)
- FScan.exe Network Scan (Windows Event Log)
- GetAdComputer with PowerShell
- GetAdComputer with PowerShell Script Block
- GetDomainComputer with PowerShell
- GetDomainComputer with PowerShell Script Block
- GetDomainController with PowerShell
- GetDomainController with PowerShell Script Block
- GetWmiObject Ds Computer with PowerShell
- GetWmiObject Ds Computer with PowerShell Script Block
- Multiple nslookup commands (Sysmon)
- Multiple nslookup commands (Windows Event Log)
- NMAP Execution
- NMAP Execution (PowerShell)
- NMAP Execution (Windows Event Log)
- Potential Ping Sweep (Windows Event Log)
- PowerHuntShares Commands (PowerShell)
- PowerHuntShares Commands (Sysmon)
- PowerHuntShares Commands (Windows Event Log)
- Remote System Discovery with Adsisearcher
- Remote System Discovery with Dsquery
- Remote System Discovery with Wmic
- Windows AdFind Exe
- Windows Get-AdComputer Unconstrained Delegation Discovery
- Windows Netspy Network Scanner Execution
- Windows PowerView Constrained Delegation Discovery
- Windows PowerView Unconstrained Delegation Discovery
- Windows PsTools Recon Usage
Kusto 10 rules
- Claroty - Policy violation
- Claroty - Suspicious activity
- Claroty - Suspicious file transfer
- Claroty - Threat detected
- Hunt for ADWS requests from unknown devices
- LDAP reconnaissance via search filters
- Probable AdFind Recon Tool Usage
- Probable AdFind Recon Tool Usage (Normalized Process Events)
- SonicWall - Allowed SSH, Telnet, and RDP Connections
- Tailscale Premium: Mass fan-out from single node