Techniques › T1016
T1016 System Network Configuration Discovery
discovery — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
12
Sigma rules tagged attack.t1016
1
KEV CVEs mapped here
<p>Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.</p><p>Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>). On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command
esxcli network nic list will retrieve the MAC address, while esxcli network ip interface ipv4 get will retrieve the local IPv4 address.</p><p>Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2021-40449 | Microsoft Windows | secondary impact | Mapped | 2021-11-17 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0195 Behavioral Detection of System Network Configuration Discovery v1.0
AN0559 WindowsExecution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.Tunable:
ParentProcessUserContextTimeWindowAN0560 LinuxExecution ofifconfig,ip a, or access to/proc/net/indicating collection of local interface and route configuration.Tunable:CommandLinePatternInteractiveShellIndicatorAN0561 macOSExecution ofifconfig,networksetup, orsystem_profilerto query IP/MAC/interface configuration and status.Tunable:ScriptedContextExecutionFrequencyAN0562 ESXiUse ofesxcli networkcommands (e.g.,esxcli network nic list,esxcli network ip interface ipv4 get) via SSH or hostd to enumerate adapter and IP information.Tunable:SSHSessionOriginesxcliCommandDepthAN0563 Network DevicesCLI-based execution of interface and routing discovery commands (e.g.,show ip interface,show arp,show route) over Telnet, SSH, or console.Tunable:UsernameCommandStringTransportType
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1016
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
· 2021-12-07 (modified 2025-10-18) · logsource: product=windows category=process_creation · 0e4164da-94bc-450d-a7be-a4b176179f1f
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2023-02-09 (modified 2024-08-01) · logsource: product=windows category=process_creation · 43311e65-84d8-42a5-b3d4-c94d9b67038f
Detects suspicious enumeration of the domain the user is associated with.
Author: remotephone, oscd.community
· 2020-10-06 (modified 2024-08-29) · logsource: product=macos category=process_creation · 58800443-f9fc-4d55-ae0c-98a3966dfb97
Detects enumeration of local network configuration
Author: Craig Young, oscd.community, Georg Lauenstein
· 2021-07-24 (modified 2023-12-15) · logsource: product=windows category=process_creation · 5cc90652-4cbd-4241-aa3b-4b462fa5a248
Detects nltest commands that can be used for information discovery
Author: Andreas Braathen (mnemonic.io)
· 2023-10-27 (modified 2024-01-26) · logsource: product=windows category=process_creation · 698d4431-514f-4c82-af4d-cf573872a9f5
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Author: Arun Chauhan
· 2023-02-03 · logsource: product=windows category=process_creation · 903076ff-f442-475a-b667-4f246bcc203b
Detects nltest commands that can be used for information discovery
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
· 2021-12-07 (modified 2025-10-19) · logsource: product=windows category=process_creation · a29c1813-ab1f-4dde-b489-330b952e91ae
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Author: Ömer Günal and remotephone, oscd.community
· 2020-10-06 (modified 2022-09-15) · logsource: product=linux category=process_creation · e7bd1cfa-b446-4c88-8afb-403bcd79e3fa
Detects enumeration of local network configuration
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2023-07-13 · logsource: product=windows category=ps_module · ea207a23-b441-4a17-9f76-ad5be47d51d3
Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
· 2023-04-24 (modified 2024-03-22) · logsource: product=windows category=network_connection · edf3485d-dac4-4d50-90e4-b0e5813f7e60
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.