{"id":"T1049","name":"System Network Connections Discovery","url":"https://attack.mitre.org/techniques/T1049","tactics":["discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0320","stix_id":"x-mitre-detection-strategy--7c45d09a-030e-4b30-b2d9-41fee3daa293","name":"Detection of System Network Connections Discovery Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0320","analytics":[{"id":"AN0903","stix_id":"x-mitre-analytic--d78b4bb3-bd0a-4e43-bc19-0a7b72f6a9d3","name":"Analytic 0903","description":"Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.","url":"https://attack.mitre.org/detectionstrategies/DET0320#AN0903","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"SuspiciousParentProcesses","description":"Non-standard binaries launching PowerShell or netstat (e.g., winword.exe spawning powershell.exe)."},{"field":"TimeWindow","description":"Correlates discovery behavior before lateral movement or credential access."},{"field":"CommandPatternList","description":"Regex or keyword patterns to match discovery utilities (e.g., `netstat`, `Get-NetTCPConnection`)."}],"live":true,"detection_strategies":["DET0320"],"techniques":["T1049"]},{"id":"AN0904","stix_id":"x-mitre-analytic--10dcfce8-70df-4682-ab04-90279d7292f9","name":"Analytic 0904","description":"Detects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.","url":"https://attack.mitre.org/detectionstrategies/DET0320#AN0904","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:cli","channel":"command logging","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-cli"}],"mutable_elements":[{"field":"UtilityNameList","description":"List of binaries used for discovery (e.g., netstat, ss, lsof)."},{"field":"UserContextScope","description":"Limit detection to non-administrative or service accounts performing enumeration."},{"field":"ExecutionFrequencyThreshold","description":"Unusual number of executions within a short time window."}],"live":true,"detection_strategies":["DET0320"],"techniques":["T1049"]},{"id":"AN0905","stix_id":"x-mitre-analytic--635f834e-ee46-496f-aec4-23dbef04451b","name":"Analytic 0905","description":"Detects shell-based enumeration of active connections using `netstat`, `lsof -i`, or AppleScript-based system discovery.","url":"https://attack.mitre.org/detectionstrategies/DET0320#AN0905","platforms":["macOS"],"log_source_references":[{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"ShellCommandWatchlist","description":"Matches terminal commands like `lsof -i`, `netstat`, or scripts issued via Automator or AppleScript."},{"field":"TerminalBinaryDenylist","description":"Tracks execution of networking discovery tools by apps outside Terminal.app or iTerm."}],"live":true,"detection_strategies":["DET0320"],"techniques":["T1049"]},{"id":"AN0906","stix_id":"x-mitre-analytic--d42c2a80-bf02-460f-b279-147940ece3a9","name":"Analytic 0906","description":"Detects shell or API usage of `esxcli network ip connection list` or `netstat` to enumerate ESXi host connections.","url":"https://attack.mitre.org/detectionstrategies/DET0320#AN0906","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"command log","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"ExecutionOriginCheck","description":"Detect commands executed outside normal management interfaces (e.g., SSH or root shell)."},{"field":"ExpectedAdminAccessWindow","description":"Timeframe when host connection audits are expected (e.g., maintenance windows)."}],"live":true,"detection_strategies":["DET0320"],"techniques":["T1049"]},{"id":"AN0907","stix_id":"x-mitre-analytic--c6208aa1-fa6e-4d9d-a284-dd0aab1ee31c","name":"Analytic 0907","description":"Detects interactive or automated use of CLI commands like `show ip sockets`, `show tcp brief`, or SNMP queries for active sessions on routers/switches.","url":"https://attack.mitre.org/detectionstrategies/DET0320#AN0907","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:cli","channel":"command logs","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-cli"},{"name":"snmp:trap","channel":"management queries","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"snmp-trap"}],"mutable_elements":[{"field":"CommandPatternList","description":"Monitors for known socket/session query strings."},{"field":"PrivilegedUserCheck","description":"Restrict detections to non-admin roles executing advanced queries."}],"live":true,"detection_strategies":["DET0320"],"techniques":["T1049"]},{"id":"AN0908","stix_id":"x-mitre-analytic--914a5b13-5977-4e62-abab-9ee03e72624f","name":"Analytic 0908","description":"Detects enumeration of cloud network interfaces, VPCs, subnets, or peer connections using CLI or SDKs (e.g., AWS CLI, Azure CLI, GCloud CLI).","url":"https://attack.mitre.org/detectionstrategies/DET0320#AN0908","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"Describe* or List* API calls","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"aws-cloudtrail"},{"name":"azure:activity","channel":"networkInsightsLogs","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"azure-activity"}],"mutable_elements":[{"field":"ServicePrincipalAllowlist","description":"Allow certain automation roles to perform discovery during provisioning."},{"field":"BurstQueryThreshold","description":"Unusual number of Describe* or List* network API calls in a short timeframe."}],"live":true,"detection_strategies":["DET0320"],"techniques":["T1049"]}],"live":true,"version":"1.0","techniques":["T1049"]}],"sigma_rules":[{"id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","title":"Net.EXE Execution","author":"Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)","status":"test","level":"low","date":"2019-01-16","modified":"2022-07-11","description":"Detects execution of \"Net.EXE\".","references":["https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/","https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html","https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html","https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","attack.t1049","attack.t1018","attack.t1135","attack.t1201","attack.t1069.001","attack.t1069.002","attack.t1087.001","attack.t1087.002","attack.lateral-movement","attack.t1021.002","attack.s0039","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml","techniques":["T1007","T1049","T1018","T1135","T1201","T1069.001","T1069.002","T1087.001","T1087.002","T1021.002"],"cves":[]},{"id":"1c67a717-32ba-409b-a45d-0fb704a73a81","title":"System Network Connections Discovery Via Net.EXE","author":"frack113","status":"test","level":"low","date":"2021-12-10","modified":"2023-02-21","description":"Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1049"],"path":"rules/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml","techniques":["T1049"],"cves":[]},{"id":"4c519226-f0cd-4471-bd2f-6fbb2bb68a79","title":"System Network Connections Discovery - Linux","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"low","date":"2020-10-19","modified":"2023-01-17","description":"Detects usage of system utilities to discover system network connections","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1049"],"path":"rules/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml","techniques":["T1049"],"cves":[]},{"id":"698d4431-514f-4c82-af4d-cf573872a9f5","title":"Potential Pikabot Discovery Activity","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"high","date":"2023-10-27","modified":"2024-01-26","description":"Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.\nThe malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).\n","references":["https://www.virustotal.com/gui/file/72f1a5476a845ea02344c9b7edecfe399f64b52409229edaf856fcb9535e3242","https://tria.ge/231023-lpw85she57/behavioral2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1016","attack.t1049","attack.t1087","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml","techniques":["T1016","T1049","T1087"],"cves":[]},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Find information about network devices that is not stored in config files","references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","techniques":["T1083","T1201","T1057","T1018","T1082","T1016","T1049","T1033","T1124"],"cves":[]},{"id":"9a7a0393-2144-4626-9bf1-7c2f5a7321db","title":"System Network Connections Discovery - MacOs","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"informational","date":"2020-10-19","modified":"2022-12-28","description":"Detects usage of system utilities to discover system network connections","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1049"],"path":"rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml","techniques":["T1049"],"cves":[]},{"id":"aff815cc-e400-4bf0-a47a-5d8a2407d4e1","title":"Use Get-NetTCPConnection - PowerShell Module","author":"frack113","status":"test","level":"low","date":"2021-12-10","modified":"2022-12-02","description":"Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.discovery","attack.t1049"],"path":"rules/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml","techniques":["T1049"],"cves":[]},{"id":"b2317cfa-4a47-4ead-b3ff-297438c0bc2d","title":"HackTool - SharpView Execution","author":"frack113","status":"test","level":"high","date":"2021-12-10","modified":"2023-02-14","description":"Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems","references":["https://github.com/tevora-threat/SharpView/","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1049","attack.t1069.002","attack.t1482","attack.t1135","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml","techniques":["T1049","T1069.002","T1482","T1135","T1033"],"cves":[]},{"id":"b366adb4-d63d-422d-8a2c-186463b5ded0","title":"Use Get-NetTCPConnection","author":"frack113","status":"test","level":"low","date":"2021-12-10","modified":"2023-10-27","description":"Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.discovery","attack.t1049"],"path":"rules/windows/powershell/powershell_classic/posh_pc_susp_get_nettcpconnection.yml","techniques":["T1049"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2022-41328","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}