System Network Connections Discovery T1049

Tactic: Discovery

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Events covered

14 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 36 rules share fields, values, and exclusions.

Fields filtered most (34 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
CommandLine17contains 8, regex_match 5, ends_with 2, eq 2, in 2, is_not_null 1(?i)netstat(\.exe)?|net(\.exe)?\s+(use|sessions)|Get-TCPC..., (?i)whoami|systeminfo|ipconfig|arp|nltest|dclist|domain_t..., accounts, group, localgroup
process_name14eq 10, in 2, regex_match 2, contains 1arp.exe, (?i)(whoami|systeminfo|ipconfig|arp|nltest|tasklist|net1?..., atbroker.exe, bginfo.exe, net.exe
EventID8eq 84104, 4688, 1, 4103
Image6ends_with 5, eq 1, is_not_null 1, starts_with 1, wildcard 1/last, /lsof, /netstat, \net.exe, \net1.exe
OriginalFileName6eq 6net.exe, net1.exe, netsh.exe, sharpview.exe
event.type6eq 6start
host.os.type6eq 5, in 1
EventType3eq 2, in 1exec, exec_event, fork
event.category3eq 3process
process.args3eq 2, in 2, starts_with 1, wildcard 1*.cluster.local, *.svc, *.svc.cluster.local, -s, config
ParentImage2ends_with 1, eq 1?:\program files (x86)\teamcity\jre\bin\java.exe, ?:\program files\teamcity\jre\bin\java.exe, ?:\teamcity\buildagent\jre\bin\java.exe, \searchfilterhost.exe, \searchprotocolhost.exe
ScriptBlockText2contains 1, eq 1, in 1.getgporeport(), ::getipglobalproperties(), ::getprocesses, get-nettcpconnection
Type2eq 2
dc_process2gt 23
dc_process_name2gt 21

Top indicator values (471 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
61078
process_nameeq
net.exe
528
process_nameeq
netstat.exe
59
process_nameeq
arp.exe
49
process_nameeq
nbtstat.exe
49
process_nameeq
net1.exe
439
process_nameeq
netsh.exe
421
process_nameeq
dsget.exe
38
process_nameeq
dsquery.exe
312
process_nameeq
gpresult.exe
37
process_nameeq
hostname.exe
37
process_nameeq
ipconfig.exe
310
process_nameeq
nltest.exe
311
process_nameeq
ping.exe
310
process_nameeq
powershell.exe
3184
process_nameeq
qprocess.exe
38
process_nameeq
quser.exe
310
process_nameeq
qwinsta.exe
39
process_nameeq
reg.exe
327
process_nameeq
sc.exe
332
process_nameeq
systeminfo.exe
39
process_nameeq
tasklist.exe
310
process_nameeq
tracert.exe
36
process_nameeq
whoami.exe
312
OriginalFileNameeq
net.exe
431
OriginalFileNameeq
net1.exe
444
CommandLineregex_match
(?i)netstat(\.exe)?|net(\.exe)?\s+(use|sessions)|Get-TCPConnection
33
EventIDeq
4104
3269
EventIDeq
4688
3317
event.categoryeq
process
3142

Exclusions (132 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLineregex_match
(?i)\x5cSplunkUniversalForwarder\x5c(etc|bin)\x5c
2
userregex_match
\$$
2
CurrentDirectoryin
/opt/microsoft/mdatp/sbin
1
CurrentDirectoryin
/usr/lib/check_mk_agent/plugins
1
CurrentDirectoryin
/var/ossec
1
EventDatacontains
gc_service.exe
1
EventDatacontains
gc_worker.exe
1
Imageends_with
/who
1
Imagestarts_with
/run/containerd/
1
Imagestarts_with
/srv/snp/docker/
1
Imagestarts_with
/tmp/.criu
1
Imagestarts_with
/tmp/go-build
1
ParentCommandLinecontains
/usr/bin/landscape-sysinfo
1
ParentCommandLineregex_match
(?i)\x5cSplunkUniversalForwarder\x5c(etc|bin)\x5c
1
ParentImagecontains
gc_service.exe
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 9 rules

Elastic 9 rules

Splunk 17 rules

Kusto 1 rule