{"id":"T1016.001","name":"Internet Connection Discovery","url":"https://attack.mitre.org/techniques/T1016/001","tactics":["discovery"],"platforms":["Windows","Linux","macOS","ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0357","stix_id":"x-mitre-detection-strategy--24eeb599-bc8c-4e86-9adf-232153bcb14b","name":"Behavioral Detection of Internet Connection Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0357","analytics":[{"id":"AN1015","stix_id":"x-mitre-analytic--aa2dc7aa-0cc5-4a75-96b2-8c089c46944b","name":"Analytic 1015","description":"Execution of utilities (e.g., ping, tracert, Test-NetConnection) or scripted methods to test Internet connectivity by interacting with external IPs/domains.","url":"https://attack.mitre.org/detectionstrategies/DET0357#AN1015","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Security","channel":"EventCode=5156, 5157","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"DestinationIP","description":"Tunable external IP ranges or domains used to verify Internet access (e.g., 8.8.8.8, example.com)"},{"field":"TimeWindow","description":"Cluster rapid test connections with command execution in < 60 seconds"},{"field":"UserContext","description":"Filter out known admin/script contexts to reduce false positives"}],"live":true,"detection_strategies":["DET0357"],"techniques":["T1016.001"]},{"id":"AN1016","stix_id":"x-mitre-analytic--bdba541c-3a01-4a6d-95ae-15e283f2909b","name":"Analytic 1016","description":"Execution of ping, traceroute, or curl/wget against public IPs/domains to verify Internet reachability.","url":"https://attack.mitre.org/detectionstrategies/DET0357#AN1016","platforms":["Linux"],"log_source_references":[{"name":"auditd:EXECVE","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"},{"name":"linux:syslog","channel":"network","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"DomainPatterns","description":"Regex for common test domains like example.com, google.com"},{"field":"ProtocolType","description":"Adjust focus to ICMP, HTTP, or mixed protocol testing"}],"live":true,"detection_strategies":["DET0357"],"techniques":["T1016.001"]},{"id":"AN1017","stix_id":"x-mitre-analytic--1443f662-d249-4458-b8fe-2c2da7b64569","name":"Analytic 1017","description":"Execution of ping, traceroute, or network utility tools to external destinations; may include `scutil` or system_profiler.","url":"https://attack.mitre.org/detectionstrategies/DET0357#AN1017","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ExecutionFrequency","description":"Rare use of ICMP utilities may be tuned based on user/host baselines"},{"field":"EnrichmentLevel","description":"Tune data joins with parent process and user activity context"}],"live":true,"detection_strategies":["DET0357"],"techniques":["T1016.001"]},{"id":"AN1018","stix_id":"x-mitre-analytic--ef76221d-d5fe-4285-af27-54711e94e2b5","name":"Analytic 1018","description":"Execution of `ping`, `vmkping`, or `curl` from shell or through automation jobs/scripts to verify Internet egress.","url":"https://attack.mitre.org/detectionstrategies/DET0357#AN1018","platforms":["ESXi"],"log_source_references":[{"name":"esxi:shell","channel":"None","data_component":"DC0029","data_component_name":"Script Execution","log_source_slug":"esxi-shell"},{"name":"esxi:hostd","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"SSHSessionOrigin","description":"Distinguish external SSH sessions from internal admin maintenance"},{"field":"TargetIP","description":"Egress test destination may be filtered to known CDNs/test nodes"}],"live":true,"detection_strategies":["DET0357"],"techniques":["T1016.001"]}],"live":true,"version":"1.0","techniques":["T1016.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}