{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1018","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"9138ef8ce473f87cd4ba8c7badae6d8ed8f0271f010d81d2df371606da8cf6c2","description":"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as  [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`.\n\nAdversaries may also analyze data from local host files (ex: <code>C:\\Windows\\System32\\Drivers\\etc\\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment.\n\nAdversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)  \n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1018","external_id":"T1018"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"},{"source_name":"Elastic - Koadiac Detection with EQL","description":"Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.","url":"https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"},{"source_name":"US-CERT-TA18-106A","description":"US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1018","technique_page":"techniques/enterprise/T1018/","page":"detections/enterprise/T1018/","status":"rule_source_available","counts":{"sigma":16,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"11063ec2-de63-4153-935e-b1a8b9e616f1","title":"Linux Remote System Discovery","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/11063ec2-de63-4153-935e-b1a8b9e616f1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml","author":"Alejandro Ortuno, oscd.community","kind":"sigma"},{"id":"10227522-8429-47e6-a301-f2b2d014e7ad","title":"Macos Remote System Discovery","status":"test","level":"informational","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/10227522-8429-47e6-a301-f2b2d014e7ad.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml","author":"Alejandro Ortuno, oscd.community","kind":"sigma"},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","status":"test","level":"low","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","author":"Austin Clark","kind":"sigma"},{"id":"1f6399cf-2c80-4924-ace1-6fcff3393480","title":"DirectorySearcher Powershell Exploitation","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/1f6399cf-2c80-4924-ace1-6fcff3393480.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml","author":"frack113","kind":"sigma"},{"id":"36bed6b2-e9a0-4fff-beeb-413a92b86138","title":"Active Directory Computers Enumeration With Get-AdComputer","status":"test","level":"low","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/36bed6b2-e9a0-4fff-beeb-413a92b86138.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml","author":"frack113","kind":"sigma"},{"id":"cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5","title":"Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock","status":"experimental","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enable"},"data_path":"data/detection-rules/cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml","author":"frack113","kind":"sigma"},{"id":"7638e5fe-600c-4289-a968-f49dd537ec7d","title":"HackTool - NetExec Execution","status":"experimental","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7638e5fe-600c-4289-a968-f49dd537ec7d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_netexec.yml","author":"Chirag Damani","kind":"sigma"},{"id":"62510e69-616b-4078-b371-847da438cc03","title":"Share And Session Enumeration Using Net.EXE","status":"stable","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/62510e69-616b-4078-b371-847da438cc03.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml","author":"Endgame, JHasenbusch (ported for oscd.community)","kind":"sigma"},{"id":"903076ff-f442-475a-b667-4f246bcc203b","title":"Nltest.EXE Execution","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/903076ff-f442-475a-b667-4f246bcc203b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_nltest_execution.yml","author":"Arun Chauhan","kind":"sigma"},{"id":"9a132afa-654e-11eb-ae93-0242ac130002","title":"PUA - AdFind Suspicious Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9a132afa-654e-11eb-ae93-0242ac130002.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml","author":"Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community","kind":"sigma"},{"id":"26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160","title":"PUA - Adidnsdump Execution","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_python_adidnsdump.yml","author":"frack113","kind":"sigma"},{"id":"df55196f-f105-44d3-a675-e9dfb6cc2f2b","title":"Renamed AdFind Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/df55196f-f105-44d3-a675-e9dfb6cc2f2b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f8ad2e2c-40b6-4117-84d7-20b89896ab23","title":"Suspicious Scan Loop Network","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f8ad2e2c-40b6-4117-84d7-20b89896ab23.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml","author":"frack113","kind":"sigma"},{"id":"fa3c117a-bc0d-416e-a31b-0c0e80653efb","title":"Chopper Webshell Process Pattern","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fa3c117a-bc0d-416e-a31b-0c0e80653efb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_chopper.yml","author":"Florian Roth (Nextron Systems), MSTI (query)","kind":"sigma"},{"id":"4ebc877f-4612-45cb-b3a5-8e3834db36c9","title":"Webshell Hacking Activity Patterns","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/4ebc877f-4612-45cb-b3a5-8e3834db36c9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_hacking.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"bed2a484-9348-4143-8a8a-b801c979301c","title":"Webshell Detection With Command Line Keywords","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bed2a484-9348-4143-8a8a-b801c979301c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0574","name":"Detection Strategy for Remote System Enumeration Behavior","url":"https://attack.mitre.org/detectionstrategies/DET0574","stix_id":"x-mitre-detection-strategy--9ec6dafe-3e93-4ebb-943e-26b84136f6a9","relationship_id":"relationship--1a34cffa-3bac-4b7f-a011-4d09aca360b6","description":"","analytics":[{"id":"AN1583","name":"Analytic 1583","guidance":"Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1583","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Define bursty execution patterns of enumeration commands (e.g., <30s)"},{"field":"CommandLinePattern","description":"Tunable per org’s scripting/IT tools (e.g., exclude SCCM, PsExec)"},{"field":"ParentProcess","description":"Flag suspicious process ancestry (e.g., Word.exe spawning net.exe)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1583","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1583","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1583","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1583","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1584","name":"Analytic 1584","guidance":"Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1584","platforms":["Linux"],"tuning":[{"field":"TargetIPRange","description":"Tune for sensitive internal segments or known lateral targets"},{"field":"ShellContext","description":"Distinguish user-interactive enumeration vs. cronjob or baseline tooling"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:EXECVE","channel":"execve","platforms":["Linux"],"analytic_id":"AN1584","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1584","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"linux:syslog","channel":"network","platforms":["Linux"],"analytic_id":"AN1584","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1584","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1585","name":"Analytic 1585","guidance":"Execution of built-in or AppleScript-based system enumeration via `arp`, `netstat`, `ping`, and discovery of `/etc/hosts` contents.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1585","platforms":["macOS"],"tuning":[{"field":"ExecutionUser","description":"Limit detection to suspicious users or automation contexts"},{"field":"CommandSignature","description":"Adapt for expected enumeration tooling used in IT"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process","platforms":["macOS"],"analytic_id":"AN1585","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1585","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"macos:osquery","channel":"file_events","platforms":["macOS"],"analytic_id":"AN1585","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1585","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1586","name":"Analytic 1586","guidance":"ESXi shell or SSH access issuing `esxcli network diag ping` or viewing routing tables to identify connected hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1586","platforms":["ESXi"],"tuning":[{"field":"ESXCommandPattern","description":"Match specific diag/debug commands abused for recon"},{"field":"RemoteUserShell","description":"Detect unauthorized shell use or user context (e.g., root over SSH)"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:hostd","channel":"None","platforms":["ESXi"],"analytic_id":"AN1586","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1586","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1587","name":"Analytic 1587","guidance":"Execution of discovery commands like `show cdp neighbors`, `show arp`, and other interface-level introspection on Cisco or Juniper devices.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1587","platforms":["Network Devices"],"tuning":[{"field":"CommandList","description":"Device-specific recon commands to monitor based on make/model"},{"field":"PrivLevel","description":"Trigger detection for privilege escalation prior to recon commands"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"syslog facility LOCAL7 or trap messages","platforms":["Network Devices"],"analytic_id":"AN1587","source_url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1587","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0552","name":"AdFind","page":"tools/S0552/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0099","name":"Arp","page":"tools/S0099/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0359","name":"Nltest","page":"tools/S0359/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0097","name":"Ping","page":"tools/S0097/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0684","name":"ROADTools","page":"tools/S0684/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0552","name":"AdFind","page":"tools/S0552/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0099","name":"Arp","page":"tools/S0099/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0590","name":"NBTscan","page":"tools/S0590/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0359","name":"Nltest","page":"tools/S0359/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0097","name":"Ping","page":"tools/S0097/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0684","name":"ROADTools","page":"tools/S0684/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0018","name":"Sykipot","url":"https://attack.mitre.org/software/S0018","kind":"malware","description":"[Sykipot](https://attack.mitre.org/software/S0018) may use <code>net view /domain</code> to display hostnames of available systems on a network.(Citation: AlienVault Sykipot 2011)","relationship_id":"relationship--7fe49f05-8f96-4fc2-bc5b-b2eea59efca3","references":[{"source_name":"AlienVault Sykipot 2011","description":"Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.","url":"https://www.alienvault.com/open-threat-exchange/blog/another-sykipot-sample-likely-targeting-us-federal-agencies"}]},{"id":"S0039","name":"Net","url":"https://attack.mitre.org/software/S0039","kind":"tool","description":"Commands such as <code>net view</code> can be used in [Net](https://attack.mitre.org/software/S0039) to gather information about available remote systems.(Citation: Savill 1999)","relationship_id":"relationship--31ec568c-53c7-4dfb-8bfb-bfb7addca7ee","references":[{"source_name":"Savill 1999","description":"Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.","url":"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"}]},{"id":"S0063","name":"SHOTPUT","url":"https://attack.mitre.org/software/S0063","kind":"malware","description":"[SHOTPUT](https://attack.mitre.org/software/S0063) has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.(Citation: Palo Alto CVE-2015-3113 July 2015)","relationship_id":"relationship--9ea25bfb-3e3a-42cb-8d2a-939169057806","references":[{"source_name":"Palo Alto CVE-2015-3113 July 2015","description":"Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) uses the <code>net view</code> command on the victim’s machine.(Citation: Kaspersky Turla)","relationship_id":"relationship--6e576576-bcd8-42ca-aa0a-8e3e24aaeafc","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) can enumerate and map ICS-specific systems in victim environments.(Citation: Gigamon Berserk Bear October 2021)","relationship_id":"relationship--efa28055-ee37-4501-8316-32a9c709ee98","references":[{"source_name":"Gigamon Berserk Bear October 2021","description":"Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"id":"S0097","name":"Ping","url":"https://attack.mitre.org/software/S0097","kind":"tool","description":"[Ping](https://attack.mitre.org/software/S0097) can be used to identify remote systems within a network.(Citation: TechNet Ping)","relationship_id":"relationship--9b2356e1-6544-40a7-a694-8ac36a1da1b7","references":[{"source_name":"TechNet Ping","description":"Microsoft. (n.d.). Ping. Retrieved April 8, 2016.","url":"https://technet.microsoft.com/en-us/library/bb490968.aspx"}]},{"id":"S0099","name":"Arp","url":"https://attack.mitre.org/software/S0099","kind":"tool","description":"[Arp](https://attack.mitre.org/software/S0099) can be used to display a host's ARP cache, which may include address resolutions for remote systems.(Citation: TechNet Arp)(Citation: Palo Alto ARP)","relationship_id":"relationship--be4040ce-c8cf-408d-b126-0954bbc1545b","references":[{"source_name":"TechNet Arp","description":"Microsoft. (n.d.). Arp. Retrieved April 17, 2016.","url":"https://technet.microsoft.com/en-us/library/bb490864.aspx"},{"source_name":"Palo Alto ARP","description":"Palo Alto Networks. (2021, November 24). Cortex XDR Analytics Alert Reference: Uncommon ARP cache listing via arp.exe. Retrieved December 7, 2021.","url":"https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/uncommon-arp-cache-listing-via-arp-exe.html"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) can ping or traceroute a remote host.(Citation: Kaspersky ProjectSauron Technical Analysis)","relationship_id":"relationship--51742efe-5f0c-4fbf-9eb7-5e765a0a408f","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) scans the C-class subnet of the IPs on the victim's interfaces.(Citation: FireEye Shamoon Nov 2016)","relationship_id":"relationship--e1f4c08f-b5b1-4d62-8f1c-75f4302b0bce","references":[{"source_name":"FireEye Shamoon Nov 2016","description":"FireEye. (2016, November 30). FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--80299c96-9450-48bc-8161-e72a41389f6a","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0165","name":"OSInfo","url":"https://attack.mitre.org/software/S0165","kind":"malware","description":"[OSInfo](https://attack.mitre.org/software/S0165) performs a connection test to discover remote systems in the network(Citation: Symantec Buckeye)","relationship_id":"relationship--8765dd7e-33cc-4040-927d-bf0aa16d3d79","references":[{"source_name":"Symantec Buckeye","description":"Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"id":"S0233","name":"MURKYTOP","url":"https://attack.mitre.org/software/S0233","kind":"malware","description":"[MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to identify remote hosts on connected networks.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--05ee7ead-dfe8-4cd2-9e7c-8f1aada9bcde","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects a list of available servers with the command <code>net view</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--71fd7b73-462f-4629-8d95-59d0129b1503","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0241","name":"RATANKBA","url":"https://attack.mitre.org/software/S0241","kind":"malware","description":"[RATANKBA](https://attack.mitre.org/software/S0241) runs the <code>net view /domain</code> and <code>net view</code> commands.(Citation: RATANKBA)","relationship_id":"relationship--9dfdcec6-82b7-42a4-902a-3220f4d67bcf","references":[{"source_name":"RATANKBA","description":"Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}]},{"id":"S0244","name":"Comnie","url":"https://attack.mitre.org/software/S0244","kind":"malware","description":"[Comnie](https://attack.mitre.org/software/S0244) runs the <code>net view</code> command","relationship_id":"relationship--77fbad9a-3a73-4ddb-8d10-60147eb64a81","references":[]},{"id":"S0248","name":"yty","url":"https://attack.mitre.org/software/S0248","kind":"malware","description":"[yty](https://attack.mitre.org/software/S0248) uses the <code>net view</code> command for discovery.(Citation: ASERT Donot March 2018)","relationship_id":"relationship--3c021bb7-e96b-4a87-931b-d74f19ec8bcb","references":[{"source_name":"ASERT Donot March 2018","description":"Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) can enumerate computers and network devices.(Citation: Cyberreason Anchor December 2019)","relationship_id":"relationship--b0bba4a5-a3c3-4cf7-9347-c9070cb18998","references":[{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"}]},{"id":"S0335","name":"Carbon","url":"https://attack.mitre.org/software/S0335","kind":"malware","description":"[Carbon](https://attack.mitre.org/software/S0335) uses the <code>net view</code> command.(Citation: GovCERT Carbon May 2016)","relationship_id":"relationship--a951bef0-4a5a-49b0-b6bd-6a4dfbd60ca0","references":[{"source_name":"GovCERT Carbon May 2016","description":"GovCERT. (2016, May 23). Technical Report about the Espionage Case at RUAG. Retrieved November 7, 2018.","url":"https://web.archive.org/web/20170718174931/https://www.melani.admin.ch/dam/melani/de/dokumente/2016/technical%20report%20ruag.pdf.download.pdf/Report_Ruag-Espionage-Case.pdf"}]},{"id":"S0359","name":"Nltest","url":"https://attack.mitre.org/software/S0359","kind":"tool","description":"[Nltest](https://attack.mitre.org/software/S0359) may be used to enumerate remote domain controllers using options such as <code>/dclist</code> and <code>/dsgetdc</code>.(Citation: Nltest Manual)","relationship_id":"relationship--cb9f7bf4-a118-457c-95f8-512d84cf7be2","references":[{"source_name":"Nltest Manual","description":"ss64. (n.d.). NLTEST.exe - Network Location Test. Retrieved February 14, 2019.","url":"https://ss64.com/nt/nltest.html"}]},{"id":"S0365","name":"Olympic Destroyer","url":"https://attack.mitre.org/software/S0365","kind":"malware","description":"[Olympic Destroyer](https://attack.mitre.org/software/S0365) uses [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to enumerate all systems in the network.(Citation: Talos Olympic Destroyer 2018)","relationship_id":"relationship--c4a8a9ea-c24a-4ddf-9451-5855da9a4251","references":[{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"}]},{"id":"S0366","name":"WannaCry","url":"https://attack.mitre.org/software/S0366","kind":"malware","description":"[WannaCry](https://attack.mitre.org/software/S0366) scans its local network segment for remote systems to try to exploit and copy itself to.(Citation: SecureWorks WannaCry Analysis)","relationship_id":"relationship--7a116d1c-33ab-4729-abff-2e37dc387f31","references":[{"source_name":"SecureWorks WannaCry Analysis","description":"Counter Threat Unit Research Team. (2017, May 18). WCry Ransomware Analysis. Retrieved March 26, 2019.","url":"https://www.secureworks.com/research/wcry-ransomware-analysis"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) can identify remote hosts on connected networks.(Citation: Fidelis njRAT June 2013)","relationship_id":"relationship--4b314d34-1e53-46a4-a3b8-131a19b256d6","references":[{"source_name":"Fidelis njRAT June 2013","description":"Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: \"njRAT\" Uncovered. Retrieved June 4, 2019.","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) used Nmap for remote system discovery.(Citation: Talos PoetRAT April 2020)","relationship_id":"relationship--64f0efcd-e46a-4bcf-9cbe-4c890e13c01b","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}]},{"id":"S0452","name":"USBferry","url":"https://attack.mitre.org/software/S0452","kind":"malware","description":"[USBferry](https://attack.mitre.org/software/S0452) can use <code>net view</code> to gather information about remote systems.(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--15a571d1-652c-4148-9dee-12d3b1cbff62","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"S0488","name":"CrackMapExec","url":"https://attack.mitre.org/software/S0488","kind":"tool","description":"[CrackMapExec](https://attack.mitre.org/software/S0488) can discover active IP addresses, along with the machine name, within a targeted network.(Citation: CME Github September 2018)","relationship_id":"relationship--63b477c5-b88b-469d-8b2a-bc30507de54f","references":[{"source_name":"CME Github September 2018","description":"byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}]},{"id":"S0521","name":"BloodHound","url":"https://attack.mitre.org/software/S0521","kind":"tool","description":"[BloodHound](https://attack.mitre.org/software/S0521) can enumerate and collect the properties of domain computers, including domain controllers.(Citation: CrowdStrike BloodHound April 2018)","relationship_id":"relationship--841f6044-8c12-4063-b911-d1da4c8d6fdc","references":[{"source_name":"CrowdStrike BloodHound April 2018","description":"Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.","url":"https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can enumerate remote systems using <code> Net View</code>.(Citation: Cybereason Bazar July 2020)","relationship_id":"relationship--16d19ac1-de53-44e2-9139-32b0e0525b0c","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}]},{"id":"S0552","name":"AdFind","url":"https://attack.mitre.org/software/S0552","kind":"tool","description":"[AdFind](https://attack.mitre.org/software/S0552) has the ability to query Active Directory for computers.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: Cybereason Bumblebee August 2022)","relationship_id":"relationship--dfe9acb4-48fe-4241-8b17-d76534f75b62","references":[{"source_name":"Red Canary Hospital Thwarted Ryuk October 2020","description":"Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source_name":"Cybereason Bumblebee August 2022","description":"Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"},{"source_name":"FireEye Ryuk and Trickbot January 2019","description":"Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source_name":"FireEye FIN6 Apr 2019","description":"McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) can use <code>net view</code> to discover remote systems.(Citation: Crowdstrike Indrik November 2018)","relationship_id":"relationship--0c8370b1-efd1-4e5d-86c9-d3ffba1bb22d","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"\n[Conti](https://attack.mitre.org/software/S0575) has the ability to discover hosts on a target network.(Citation: CrowdStrike Wizard Spider October 2020)","relationship_id":"relationship--9c424acf-2a41-4b34-867f-590ade731fc2","references":[{"source_name":"CrowdStrike Wizard Spider October 2020","description":"Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}]},{"id":"S0586","name":"TAINTEDSCRIBE","url":"https://attack.mitre.org/software/S0586","kind":"malware","description":"The [TAINTEDSCRIBE](https://attack.mitre.org/software/S0586) command and execution module can perform target system enumeration.(Citation: CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020)","relationship_id":"relationship--07324f90-f7c1-41f7-8d08-3ecec98bbe5c","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","description":"USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}]},{"id":"S0590","name":"NBTscan","url":"https://attack.mitre.org/software/S0590","kind":"tool","description":"[NBTscan](https://attack.mitre.org/software/S0590) can list NetBIOS computer names.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)\t","relationship_id":"relationship--be8fb0e9-a924-47be-9bb6-1eebe05881b7","references":[{"source_name":"Debian nbtscan Nov 2019","description":"Bezroutchko, A. (2019, November 19). NBTscan man page. Retrieved March 17, 2021.","url":"https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html"},{"source_name":"SecTools nbtscan June 2003","description":"SecTools. (2003, June 11). NBTscan. Retrieved March 17, 2021.","url":"https://sectools.org/tool/nbtscan/"}]},{"id":"S0599","name":"Kinsing","url":"https://attack.mitre.org/software/S0599","kind":"malware","description":"[Kinsing](https://attack.mitre.org/software/S0599) has used a script to parse files like <code>/etc/hosts</code> and SSH <code>known_hosts</code> to discover remote systems.(Citation: Aqua Kinsing April 2020)","relationship_id":"relationship--ab0c8d2a-b2da-4566-96f5-1cbbc9a41300","references":[{"source_name":"Aqua Kinsing April 2020","description":"Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) can enumerate remote computers in the compromised network.(Citation: ESET Industroyer)","relationship_id":"relationship--50cf1a8b-5ed4-4155-a09d-ed65cf9c4a08","references":[{"source_name":"ESET Industroyer","description":"Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S0646","name":"SpicyOmelette","url":"https://attack.mitre.org/software/S0646","kind":"malware","description":"[SpicyOmelette](https://attack.mitre.org/software/S0646) can identify payment systems, payment gateways, and ATM systems in compromised environments.(Citation: Secureworks GOLD KINGSWOOD September 2018)","relationship_id":"relationship--b6609907-ec91-4339-a1ed-811bfe6ca48e","references":[{"source_name":"Secureworks GOLD KINGSWOOD September 2018","description":"CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can identify remote systems through the <code>net view</code> command.(Citation: Crowdstrike Qakbot October 2020)(Citation: Kaspersky QakBot September 2021)(Citation: Trend Micro Black Basta October 2022)","relationship_id":"relationship--0cbe929a-96e2-4ff8-bf8d-501a9a8d2ad2","references":[{"source_name":"Crowdstrike Qakbot October 2020","description":"CS. (2020, October 7). Duck Hunting with Falcon Complete: A Fowl Banking Trojan Evolves, Part 2. Retrieved September 27, 2021.","url":"https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"},{"source_name":"Trend Micro Black Basta October 2022","description":"Kenefick, I. et al. (2022, October 12). Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike. Retrieved February 6, 2023.","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) can use the ARP table to find remote hosts to scan.(Citation: Fortinet Diavol July 2021) ","relationship_id":"relationship--afe9286d-076f-49af-90f3-11ebbe82ad40","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0684","name":"ROADTools","url":"https://attack.mitre.org/software/S0684","kind":"tool","description":"[ROADTools](https://attack.mitre.org/software/S0684) can enumerate Azure AD systems and devices.(Citation: Roadtools)","relationship_id":"relationship--0b2d53db-2f5c-4dc7-97de-f0c12e22472c","references":[{"source_name":"Roadtools","description":"Dirk-jan Mollema. (2020, April 16). Introducing ROADtools - The Azure AD exploration framework. Retrieved January 31, 2022.","url":"https://dirkjanm.io/introducing-roadtools-and-roadrecon-azure-ad-exploration-framework/"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can enumerate and collect the properties of domain computers.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--80b87eab-243c-4e98-a85e-2684520f8824","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0694","name":"DRATzarus","url":"https://attack.mitre.org/software/S0694","kind":"malware","description":"[DRATzarus](https://attack.mitre.org/software/S0694) can search for other machines connected to compromised host and attempt to map the network.(Citation: ClearSky Lazarus Aug 2020)","relationship_id":"relationship--86a7ffc8-6107-4854-96a7-d39f8bb4069f","references":[{"source_name":"ClearSky Lazarus Aug 2020","description":"ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) has been used to execute <code>net view</code> on a targeted system.(Citation: NTT Security Flagpro new December 2021) ","relationship_id":"relationship--8c155a65-b89f-44aa-b4c0-1374208a3fed","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S0698","name":"HermeticWizard","url":"https://attack.mitre.org/software/S0698","kind":"malware","description":"[HermeticWizard](https://attack.mitre.org/software/S0698) can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`(Citation: ESET Hermetic Wizard March 2022)","relationship_id":"relationship--9006e828-f70a-4c7e-8dce-07d1040de3e9","references":[{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can collect information about hosts on the victim network.(Citation: Kaspersky APT Trends Q1 2020)","relationship_id":"relationship--74ef18b6-ca55-4fc3-acf1-10ed585c160f","references":[{"source_name":"Kaspersky APT Trends Q1 2020","description":"Global Research and Analysis Team. (2020, April 30). APT trends report Q1 2020. Retrieved September 19, 2022.","url":"https://securelist.com/apt-trends-report-q1-2020/96826/"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.(Citation: Microsoft BlackCat Jun 2022)","relationship_id":"relationship--25b8605b-9ab2-418f-b92b-abb2be815b90","references":[{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can use LDAP queries to connect to AD and iterate over connected workstations.(Citation: Check Point Black Basta October 2022)","relationship_id":"relationship--3341a11e-acd1-4cba-a7a9-5bb48aec8bec","references":[{"source_name":"Check Point Black Basta October 2022","description":"Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023.","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.(Citation: BitDefender BADHATCH Mar 2021)","relationship_id":"relationship--18c44352-1eca-4d6e-9eac-9793b75223df","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) includes modules for performing ARP scans of local connected systems.(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--a3742518-c231-4492-9673-95e095badddf","references":[{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can use `ping` to identify remote hosts within the victim network.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--e66503db-f92a-4795-a350-732a2f92b2cd","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1198","name":"Gomir","url":"https://attack.mitre.org/software/S1198","kind":"malware","description":"[Gomir](https://attack.mitre.org/software/S1198) probes arbitrary network endpoints for TCP connectivity.(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--5fe7e204-803e-47fc-83a5-f4766d2cedfa","references":[{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) can enumerate all accessible machines from the infected system.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--68b54bc3-77f8-4b4e-bd65-bfb172b85db9","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) features a module capable of host enumeration.(Citation: Havoc Framework Documentation)\n","relationship_id":"relationship--fb038a8a-d851-4f8e-bda5-fe2d5ab20181","references":[{"source_name":"Havoc Framework Documentation","description":"Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.","url":"https://havocframework.com/docs/welcome"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can enumerate domain-connected hosts during its discovery phase.(Citation: Picus Qilin MAR 2025)(Citation: Sophos Qilin MSP APR 2025)(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--de93ce86-0bf9-4959-ab2b-b55df654b9f8","references":[{"source_name":"Sophos Qilin MSP APR 2025","description":"Bradshaw, A. et al. (2025, April 1). Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream. Retrieved September 26, 2025.","url":"https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"},{"source_name":"Picus Qilin MAR 2025","description":"Hacioglu, S. (2025, March 10). Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024. Retrieved September 26, 2025.","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can run `net view` and `net view /domain` for network discovery.(Citation: ESET MirrorFace DEC 2022)","relationship_id":"relationship--390d98f6-dd1c-4fce-a02a-4ac2c1d30934","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has scanned the local /24 subnet for new targets.(Citation: Aikido CanisterWorm MAR 2026)","relationship_id":"relationship--ebc6ef1b-fc26-4911-9637-3adb0e9b384f","references":[{"source_name":"Aikido CanisterWorm MAR 2026","description":"Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"}]},{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) has performed remote system discovery mapping harvested credentials to systems within the target environment.(Citation: AI-Mexico-Govt-Breach) ","relationship_id":"relationship--8eebd114-7d43-40da-a6b1-48a11ace403a","references":[{"source_name":"AI-Mexico-Govt-Breach","description":"Eyal Sela. (2026, April). The AI-Assisted Breach of Mexico's Government Infrastructure. Retrieved September 2, 2026.","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) has used network scanning and enumeration tools, including [Ping](https://attack.mitre.org/software/S0097).(Citation: NCC Group APT15 Alive and Strong)","relationship_id":"relationship--625ebfc0-7aaa-4eaf-8c49-be8b55c059d4","references":[{"source_name":"NCC Group APT15 Alive and Strong","description":"Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"id":"G0009","name":"Deep Panda","url":"https://attack.mitre.org/groups/G0009","kind":"intrusion-set","description":"[Deep Panda](https://attack.mitre.org/groups/G0009) has used ping to identify other machines of interest.(Citation: Alperovitch 2014)","relationship_id":"relationship--280bb6ec-0d7f-4a42-a3f2-7a3b43886126","references":[{"source_name":"Alperovitch 2014","description":"Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover remote systems on a local network using the <code>net view</code> and <code>net view /DOMAIN</code> commands. [Turla](https://attack.mitre.org/groups/G0010) has also used <code>net group \"Domain Computers\" /domain</code>, <code>net group \"Domain Controllers\" /domain</code>, and <code>net group \"Exchange Servers\" /domain</code> to enumerate domain computers, including the organization's DC and Exchange Server.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)","relationship_id":"relationship--b8a1739d-240b-46c1-a25a-b82d1c4e4765","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"G0019","name":"Naikon","url":"https://attack.mitre.org/groups/G0019","kind":"intrusion-set","description":"[Naikon](https://attack.mitre.org/groups/G0019) has used a netbios scanner for remote machine identification.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--2794f341-b46f-482c-b5b7-2cc7c2dcadb5","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"[APT3](https://attack.mitre.org/groups/G0022) has a tool that can detect the existence of remote systems.(Citation: Symantec Buckeye)(Citation: FireEye Clandestine Fox)","relationship_id":"relationship--e7714693-e792-44f0-a224-9899df75fced","references":[{"source_name":"FireEye Clandestine Fox","description":"Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source_name":"Symantec Buckeye","description":"Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) has used the <code>net view</code> command.(Citation: Nccgroup Emissary Panda May 2018)","relationship_id":"relationship--7b6eac00-8a13-42e3-b533-a40314eada68","references":[{"source_name":"Nccgroup Emissary Panda May 2018","description":"Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"id":"G0030","name":"Lotus Blossom","url":"https://attack.mitre.org/groups/G0030","kind":"intrusion-set","description":"[Lotus Blossom](https://attack.mitre.org/groups/G0030) has used [Ping](https://attack.mitre.org/software/S0097) to identify remote systems.(Citation: Symantec Bilbug 2022)","relationship_id":"relationship--93a7d544-bed2-4d8c-abda-ab0b82ffa3a9","references":[{"source_name":"Symantec Bilbug 2022","description":"Symntec Threat Hunter Team. (2022, November 12). Billbug: State-sponsored Actor Targets Cert Authority, Government Agencies in Multiple Asian Countries. Retrieved March 15, 2025.","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.(Citation: ESET Telebots Dec 2016)(Citation: Dragos Crashoverride 2018) ","relationship_id":"relationship--42d2f7f0-9548-4bdd-9e88-7200a9e91b57","references":[{"source_name":"ESET Telebots Dec 2016","description":"Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source_name":"Dragos Crashoverride 2018","description":"Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has likely obtained a list of hosts in the victim environment.(Citation: US-CERT TA18-074A)","relationship_id":"relationship--f5362c13-271a-486c-8665-996367599fd8","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0037","name":"FIN6","url":"https://attack.mitre.org/groups/G0037","kind":"intrusion-set","description":"[FIN6](https://attack.mitre.org/groups/G0037) used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.(Citation: FireEye FIN6 April 2016)","relationship_id":"relationship--ade72dc6-559e-4a84-9024-1a862faec6a0","references":[{"source_name":"FireEye FIN6 April 2016","description":"FireEye Threat Intelligence. (2016, April). Follow the Money: Dissecting the Operations of the Cyber Crime Group FIN6. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) uses scripts to enumerate IP ranges on the victim network. [menuPass](https://attack.mitre.org/groups/G0045) has also issued the command <code>net view /domain</code> to a [PlugX](https://attack.mitre.org/software/S0013) implant to gather information about remote systems on the network.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)","relationship_id":"relationship--03f32a8b-4cd9-488c-9759-37f3dff9faea","references":[{"source_name":"FireEye APT10 April 2017","description":"FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) has enumerated DC servers using the command <code>net group \"Domain Controllers\" /domain</code>. The group has also used the <code>ping</code> command.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--a6080757-7935-439b-b70f-72ba841cda03","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0053","name":"FIN5","url":"https://attack.mitre.org/groups/G0053","kind":"intrusion-set","description":"[FIN5](https://attack.mitre.org/groups/G0053) has used the open source tool Essential NetTools to map the network and build a list of targets.(Citation: Mandiant FIN5 GrrCON Oct 2016)","relationship_id":"relationship--3ef6a3fb-0d59-4ba5-b2d0-dc32d547b74f","references":[{"source_name":"Mandiant FIN5 GrrCON Oct 2016","description":"Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has used [Ping](https://attack.mitre.org/software/S0097) for discovery on targeted networks.(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--ca948787-ea4b-4022-be96-8baf0ccff834","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) typically use <code>ping</code> and [Net](https://attack.mitre.org/software/S0039) to enumerate systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)","relationship_id":"relationship--95805281-96b1-49ea-95ee-9d654178c5c3","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"id":"G0061","name":"FIN8","url":"https://attack.mitre.org/groups/G0061","kind":"intrusion-set","description":"[FIN8](https://attack.mitre.org/groups/G0061) has used [dsquery](https://attack.mitre.org/software/S0105) and other Active Directory utilities to enumerate hosts; they have also used <code>nltest.exe /dclist</code> to retrieve a list of domain controllers.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender FIN8 July 2021)","relationship_id":"relationship--ee46b157-d368-42e4-98f6-b76f6e65c9bd","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","description":"Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy:  New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source_name":"Bitdefender FIN8 July 2021","description":"Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"id":"G0077","name":"Leafminer","url":"https://attack.mitre.org/groups/G0077","kind":"intrusion-set","description":"[Leafminer](https://attack.mitre.org/groups/G0077) used Microsoft’s Sysinternals tools to gather detailed information about remote systems.(Citation: Symantec Leafminer July 2018)","relationship_id":"relationship--bfb1e467-dffc-463b-9f38-a3fafbb9d036","references":[{"source_name":"Symantec Leafminer July 2018","description":"Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used [NBTscan](https://attack.mitre.org/software/S0590) and custom tools to discover remote systems.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)","relationship_id":"relationship--964233cc-fa6c-4754-9684-6546eb6d5a4a","references":[{"source_name":"FireEye APT39 Jan 2019","description":"Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"BitDefender Chafer May 2020","description":"Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source_name":"Symantec Chafer February 2018","description":"Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"id":"G0091","name":"Silence","url":"https://attack.mitre.org/groups/G0091","kind":"intrusion-set","description":"[Silence](https://attack.mitre.org/groups/G0091) has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.(Citation: Group IB Silence Sept 2018)\t","relationship_id":"relationship--a6dc02a8-2ce3-45db-a7e5-e475d6acec3c","references":[{"source_name":"Group IB Silence Sept 2018","description":"Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"id":"G0093","name":"GALLIUM","url":"https://attack.mitre.org/groups/G0093","kind":"intrusion-set","description":"[GALLIUM](https://attack.mitre.org/groups/G0093) used a modified version of [NBTscan](https://attack.mitre.org/software/S0590) to identify available NetBIOS name servers over the network as well as <code>ping</code> to identify remote systems.(Citation: Cybereason Soft Cell June 2019)","relationship_id":"relationship--ea71022e-7f2a-4065-9cb1-304f85dbaf6d","references":[{"source_name":"Cybereason Soft Cell June 2019","description":"Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) has used MiPing to discover active systems in the victim network.(Citation: apt41_dcsocytec_dec2022) ","relationship_id":"relationship--2ea4f604-c23b-4d67-8648-f2c170378e78","references":[{"source_name":"apt41_dcsocytec_dec2022","description":"DCSO CyTec Blog. (2022, December 24). APT41 — The spy who failed to encrypt me. Retrieved June 13, 2024.","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. [Wizard Spider](https://attack.mitre.org/groups/G0102) has also used [AdFind](https://attack.mitre.org/software/S0552), <code>nltest/dclist</code>, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: CrowdStrike Grim Spider May 2019)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: DFIR Ryuk's Return October 2020)(Citation: Mandiant FIN12 Oct 2021)","relationship_id":"relationship--df13cae2-4e20-4e89-ae60-6bd8b99e2342","references":[{"source_name":"Red Canary Hospital Thwarted Ryuk October 2020","description":"Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source_name":"FireEye Ryuk and Trickbot January 2019","description":"Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source_name":"CrowdStrike Grim Spider May 2019","description":"John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source_name":"FireEye KEGTAP SINGLEMALT October 2020","description":"Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source_name":"Mandiant FIN12 Oct 2021","description":"Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source_name":"DFIR Ryuk's Return October 2020","description":"The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.(Citation: Talos Rocke August 2018)\t","relationship_id":"relationship--beae1b73-f369-4443-8e59-eb9e99665e8d","references":[{"source_name":"Talos Rocke August 2018","description":"Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has utilized various scans and queries to find domain controllers and remote services in the target environment.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--d45cd2ee-f0f6-417a-98c2-9a7e9f6dc480","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has used Angry IP Scanner to detect remote systems.(Citation: CISA AA20-259A Iran-Based Actor September 2020)","relationship_id":"relationship--1374e38c-db37-46f8-8560-63901a3e7e56","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.(Citation: Symantec WastedLocker June 2020)","relationship_id":"relationship--b2c02ae1-c62a-4811-a913-b0a26f605e38","references":[{"source_name":"Symantec WastedLocker June 2020","description":"Symantec Threat Intelligence. (2020, June 25). WastedLocker: Symantec Identifies Wave of Attacks Against U.S. Organizations. Retrieved May 20, 2021.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has enumerated domain controllers using `net group \"Domain computers\"` and `nltest /dclist`.(Citation: Rapid7 HAFNIUM Mar 2021)","relationship_id":"relationship--de7f9b12-d6e7-4ef6-b55c-77bbca0f8c83","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","description":"Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has queried Active Directory for computers using [AdFind](https://attack.mitre.org/software/S0552).(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023) [Mustang Panda](https://attack.mitre.org/groups/G0129) has also utilized SharpNBTScan to scan the victim environment.(Citation: Unit42 Chinese VSCode 06 September 2024)","relationship_id":"relationship--4f31fe80-6994-443d-ad54-7584601618dd","references":[{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source_name":"Unit42 Chinese VSCode 06 September 2024","description":"Tom Fakterman. (2024, September 6). Chinese APT Abuses VSCode to Target Government in Asia. Retrieved March 24, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"id":"G1001","name":"HEXANE","url":"https://attack.mitre.org/groups/G1001","kind":"intrusion-set","description":"[HEXANE](https://attack.mitre.org/groups/G1001) has used `net view` to enumerate domain machines.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--6679b9ed-d9ec-4ff3-9961-24f39814f6d0","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) has used tools such as Nmap and MASSCAN for remote service discovery.(Citation: CISA GRU29155 2024)","relationship_id":"relationship--01b94982-fedb-4469-adf1-7f2a2a9069ea","references":[{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) used the command <code>powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -\nproperty * | findstr “Address””</code> to find the network information of successfully logged-in accounts to discovery addresses of other machines. [Earth Lusca](https://attack.mitre.org/groups/G1006) has also used multiple scanning tools to discover other machines within the same compromised network.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--2bb7ed69-8f59-47f3-8d86-f1c1202c7629","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) can enumerate remote systems, such as VMware vCenter infrastructure.(Citation: CISA Scattered Spider Advisory November 2023)","relationship_id":"relationship--cc49c969-b227-437b-9b63-4a464766ff04","references":[{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used multiple methods, including [Ping](https://attack.mitre.org/software/S0097), to enumerate systems on compromised networks.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)","relationship_id":"relationship--40356b61-2279-47ef-b7bd-4b355e2fb98a","references":[{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","description":"Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Microsoft Volt Typhoon May 2023","description":"Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"[ToddyCat](https://attack.mitre.org/groups/G1022) has used `ping %REMOTE_HOST%` for post exploit discovery.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--8e24b237-b2a1-4d48-ae32-fd0b2d345a74","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"G1024","name":"Akira","url":"https://attack.mitre.org/groups/G1024","kind":"intrusion-set","description":"[Akira](https://attack.mitre.org/groups/G1024) uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.(Citation: Arctic Wolf Akira 2023)","relationship_id":"relationship--5d23f25a-d98a-47a6-8da7-86e8a73c3407","references":[{"source_name":"Arctic Wolf Akira 2023","description":"Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024.","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) used the tool [NBTscan](https://attack.mitre.org/software/S0590) to scan for remote, accessible hosts in victim environments.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--22ece51b-ebfa-474d-8a6e-6835ff891890","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"[Play](https://attack.mitre.org/groups/G1040) has used tools such as [AdFind](https://attack.mitre.org/software/S0552), [Nltest](https://attack.mitre.org/software/S0359), and [BloodHound](https://attack.mitre.org/software/S0521) to enumerate shares and hostnames on compromised networks.(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--4a50bbbf-990f-4556-86e2-2990bccc90e9","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to identify remotely-connected devices.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)","relationship_id":"relationship--edabd2c1-4640-4cad-b23f-c2ea4e64c7d5","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"FBI BlackByte 2022","description":"US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has used SNMPwalk to enumerate devices.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)","relationship_id":"relationship--c1affed6-5eee-4574-a921-a6102416bc5f","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has used PDQ Inventory to get an inventory of the endpoints on the network.(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)","relationship_id":"relationship--8bda3a33-7524-49e8-aa93-708d2b6a6b17","references":[{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has used [Ping](https://attack.mitre.org/software/S0097) for system discovery.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--7ad1773a-34ba-498a-ab63-9dea0181f8f8","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has enumerated the internal subnet using ` cat /etc/hosts | grep -E \"[redacted_victim_string]\"`.(Citation: Google_SHOracle_Jun2026)    ","relationship_id":"relationship--bae9c6ec-2d33-418b-b7db-8b99af22e32f","references":[{"source_name":"Google_SHOracle_Jun2026","description":"Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"id":"G1058","name":"The Gentlemen","url":"https://attack.mitre.org/groups/G1058","kind":"intrusion-set","description":"[The Gentlemen](https://attack.mitre.org/groups/G1058) has utilized internal network scanning tools to enumerate additional hosts in the victim environment to include Advanced IP Scanner.(Citation: Intel471_TheGentlemen_Aug2026)   ","relationship_id":"relationship--abcc0249-0226-440b-a32a-02512fd2db4f","references":[{"source_name":"Intel471_TheGentlemen_Aug2026","description":"Intel 471. (2026, August 11). Threat Hunting Case Study: The Gentlemen. Retrieved September 18, 2026.","url":"https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen"}]}],"mitigations":[],"candidates":[{"id":"158bd4dd-6359-40ab-b13c-285b9ef6fa25","name":"Remote System Discovery - ip neighbour","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment. \n","inputs":{},"dependencies":[{"description":"Check if ip command exists on the machine\n"}],"source_definition_sha256":"f6dc10b30bbddbe31a2a8d1475dabbf095f2bb0a59f43df94223662d6062f5f5"},{"id":"1a4ebe70-31d0-417b-ade2-ef4cb3e7d0e1","name":"Remote System Discovery - ip route","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Use the ip route command to display the kernels routing tables. \n","inputs":{},"dependencies":[{"description":"Check if ip command exists on the machine\n"}],"source_definition_sha256":"c2b14299536440101f8a502881714f28ce71bd129762254e134aaccb5f865212"},{"id":"2d5a61f5-0447-4be4-944a-1f8530ed6574","name":"Remote System Discovery - arp","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify remote systems via arp. \n\nUpon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.\n","inputs":{},"dependencies":[],"source_definition_sha256":"21bc3bed9b66bbb0818a4c5141a00de30a564a38e4f54d857a3a0e266ee188c0"},{"id":"52ab5108-3f6f-42fb-8ba3-73bc054f22c8","name":"Remote System Discovery - nltest","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify domain controllers for specified domain.\n\nUpon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.\n","inputs":{"target_domain":{"description":"Domain to query for domain controllers","type":"string","default":"%userdnsdomain%"}},"dependencies":[],"source_definition_sha256":"f1f6b0b914c532b74d63c1b8db951695100ab8643810cb0519f527a81295cd35"},{"id":"5838c31e-a0e2-4b9f-b60a-d79d2cb7995e","name":"Adfind - Enumerate Active Directory Domain Controller Objects","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects\nreference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html\n","inputs":{"optional_args":{"description":"Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use \"-arg\" notation to add arguments separated by spaces.","type":"string","default":null}},"dependencies":[{"description":"AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\\..\\ExternalPayloads\\AdFind.exe)\n"}],"source_definition_sha256":"6595c296558d24965f0d7a28bdf9264c4791ceaca96fe80eba15d821a4dc5d31"},{"id":"5843529a-5056-4bc1-9c13-a311e2af4ca0","name":"Remote System Discovery - net group Domain Controller","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify remote systems with net.exe querying the Active Directory Domain Controller.\nUpon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the \"Domain Controller\" in the domain. Output will be via stdout.\n","inputs":{},"dependencies":[],"source_definition_sha256":"8ce3f3cc4d73a808d82d72ff708fbe51ef3c0ecde158e57341632bb55dc5f4ea"},{"id":"64ede6ac-b57a-41c2-a7d1-32c6cd35397d","name":"Enumerate Active Directory Computers with ADSISearcher","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"The following Atomic test will utilize ADSISearcher to enumerate computers within Active Directory.\nUpon successful execution a listing of computers will output with their paths in AD.\nReference: https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/\n","inputs":{},"dependencies":[],"source_definition_sha256":"275676d09f1a131926431eaf6f84812769e828b9c49ba23982435bba940a1b63"},{"id":"6c2da894-0b57-43cb-87af-46ea3b501388","name":"Remote System Discovery - ip tcp_metrics","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses. \n","inputs":{},"dependencies":[{"description":"Check if ip command exists on the machine\n"}],"source_definition_sha256":"e823ecfe9eedaf04596206189aed206b59adf3362e3175c8bbf5e85d134815ac"},{"id":"6db1f57f-d1d5-4223-8a66-55c9c65a9592","name":"Remote System Discovery - ping sweep","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify remote systems via ping sweep.\n\nUpon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.\n","inputs":{"start_host":{"description":"Last octet starting value for ping sweep.","type":"string","default":"1"},"stop_host":{"description":"Last octet ending value for ping sweep.","type":"string","default":"254"},"subnet":{"description":"Subnet used for ping sweep.","type":"string","default":"192.168.1"}},"dependencies":[],"source_definition_sha256":"22b7233dac72b8a894b60ba3fe78f6321897a7ffaa1d109067eea0dcc5a45a2b"},{"id":"6fc814cb-16d1-43e6-80b3-2ff2a45250d1","name":"Enumerate SSH Configuration","platforms":["linux","macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"SSH metadata files (authorized_keys, known_hosts, config) can be used to\ndiscover remote systems and trust relationships. known_hosts\nreveals previously connected servers, config exposes host aliases and jump\nproxies, and authorized_keys shows which public keys are trusted for login.\n","inputs":{"search_path":{"description":"Directory to search under","type":"string","default":"/"},"filename":{"description":"SSH metadata file to search for","type":"string","default":"known_hosts"},"output_file":{"description":"File to write results to","type":"path","default":"/tmp/ssh_enum.txt"}},"dependencies":[],"source_definition_sha256":"e97beda1f7117b3fea24bdf65ae7c53c6c4d7a977738af106fb204ec47b5e24f"},{"id":"85321a9c-897f-4a60-9f20-29788e50bccd","name":"Remote System Discovery - net","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify remote systems with net.exe.\n\nUpon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.\n","inputs":{},"dependencies":[],"source_definition_sha256":"e600cf2f54647926dc6c29b6e2f13ac8cd36f092bbc5671c8d0f84112598e4b1"},{"id":"95e19466-469e-4316-86d2-1dc401b5a959","name":"Remote System Discovery - adidnsdump","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":3,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks\nPython 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.\nSuccessful execution of this test will list dns zones in the terminal.\n","inputs":{"user_name":{"description":"username including domain.","type":"string","default":"domain\\user"},"acct_pass":{"description":"Account password.","type":"string","default":"password"},"host_name":{"description":"hostname or ip address to connect to.","type":"string","default":"192.168.1.1"},"venv_path":{"description":"Path to the folder for the tactics venv","type":"string","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\venv_t1018"}},"dependencies":[{"description":"Computer must have python 3 installed\n"},{"description":"Computer must have venv configured at #{venv_path}\n"},{"description":"adidnsdump must be installed\n"}],"source_definition_sha256":"1e9e78efc28f3bae63e9f5367a30c9b0473863d1bdf09714fa4735e152250dda"},{"id":"962a6017-1c09-45a6-880b-adc9c57cb22e","name":"Enumerate domain computers within Active Directory using DirectorySearcher","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"This test is a Powershell script that enumerates Active Directory to determine computers that are joined to the domain. \nThis test is designed to mimic how SessionGopher can determine the additional systems within a domain, which has been used before by threat actors to aid in lateral movement. \nReference: [Head Fake: Tackling Disruptive Ransomware Attacks](https://www.mandiant.com/resources/head-fake-tackling-disruptive-ransomware-attacks). \nUpon successful execution, this test will output the names of the computers that reside on the domain to the console window. \n","inputs":{},"dependencies":[{"description":"This PC must be joined to a domain."}],"source_definition_sha256":"49f844dcddb918617fa12919afd9f8fdecbd642a0473375760a854a20e32c02a"},{"id":"96db2632-8417-4dbb-b8bb-a8b92ba391de","name":"Remote System Discovery - sweep","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify remote systems via ping sweep.\n\nUpon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.\n","inputs":{"start_host":{"description":"Subnet used for ping sweep.","type":"string","default":"1"},"stop_host":{"description":"Subnet used for ping sweep.","type":"string","default":"254"},"subnet":{"description":"Subnet used for ping sweep.","type":"string","default":"192.168.1"}},"dependencies":[],"source_definition_sha256":"ce2e72cf13fe0186f6fe822f0ec094a9f32f1a2b302d6c459aec3d24af582b51"},{"id":"97e89d9e-e3f5-41b5-a90f-1e0825df0fdf","name":"Enumerate Active Directory Computers with Get-AdComputer","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"The following Atomic test will utilize Get-AdComputer to enumerate Computers within Active Directory.\nUpon successful execution a listing of Computers will output with their paths in AD.\nReference: https://github.com/MicrosoftDocs/windows-powershell-docs/blob/main/docset/winserver2022-ps/activedirectory/Get-ADComputer.md\n","inputs":{},"dependencies":[],"source_definition_sha256":"5631539198d1cdd87b9724230f85d43dd54f1f42560739fa3d2e51e40dd79a2a"},{"id":"a889f5be-2d54-4050-bd05-884578748bb4","name":"Adfind - Enumerate Active Directory Computer Objects","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects\nreference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html\n","inputs":{"optional_args":{"description":"Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use \"-arg\" notation to add arguments separated by spaces.","type":"string","default":null}},"dependencies":[{"description":"AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\\..\\ExternalPayloads\\AdFind.exe)\n"}],"source_definition_sha256":"2bb8321aeb48d42cb0f3e6ad583f9e83a844015c738b3a9ca1abd98a38454fe7"},{"id":"acb6b1ff-e2ad-4d64-806c-6c35fe73b951","name":"Remote System Discovery - arp nix","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify remote systems via arp.\n\nUpon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.\n","inputs":{},"dependencies":[{"description":"Check if arp command exists on the machine\n"}],"source_definition_sha256":"d76cfb624916029cc840b9f02ff3a0b3bab9a56b402f07aa4eb7321c3041a8da"},{"id":"b8147c9a-84db-4ec1-8eee-4e0da75f0de5","name":"Enumerate Remote Hosts with Netscan","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"This test uses Netscan to identify remote hosts in a specified network range.","inputs":{"netscan_path":{"description":"NetScan exe location","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\netscan\\64-bit\\netscan.exe"},"range_to_scan":{"description":"The IP range to scan with Netscan","type":"string","default":"127.0.0.1-127.0.0.1"}},"dependencies":[{"description":"Netscan must be installed\n"}],"source_definition_sha256":"d9104c0a129cba153714a3084c878fca4290a064d1f5cacc9b0d33716478a86a"},{"id":"b9d2e8ca-5520-4737-8076-4f08913da2c4","name":"Get-DomainController with PowerView","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Utilizing PowerView, run Get-DomainController to identify the Domain Controller. Upon execution, information about the domain controller within the domain will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"71cfad7b742aa6c5889270303f04e0bca1774a597e60c7722b57e22a1a9403fb"},{"id":"baa01aaa-5e13-45ec-8a0d-e46c93c9760f","name":"Remote System Discovery - nslookup","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.\n\nUpon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.\n","inputs":{},"dependencies":[],"source_definition_sha256":"72ef9a2ce23fb926885b087c17d4f5a91c86952fafb95a1797548090ced4828e"},{"id":"d2791d72-b67f-4615-814f-ec824a91f514","name":"Remote System Discovery - netstat","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Use the netstat command to display the kernels routing tables.\n","inputs":{},"dependencies":[],"source_definition_sha256":"ec94490ccce73549855417e8dff5d12d1864915f5f5c098550bfec5ec9dbe7e4"},{"id":"e3cf5123-f6c9-4375-bdf2-1bb3ba43a1ad","name":"Get-WmiObject to Enumerate Domain Controllers","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"The following Atomic test will utilize get-wmiobject to enumerate Active Directory for Domain Controllers.\nUpon successful execution a listing of Systems from AD will output with their paths.\nReference: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1\n","inputs":{},"dependencies":[],"source_definition_sha256":"53c6f950fb0fb01fe593f00f0d2498fa064714e0923b470cdbb806d422e77e7c"},{"id":"f1bf6c8f-9016-4edf-aff9-80b65f5d711f","name":"Remote System Discovery - net group Domain Computers","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1018/T1018.yaml","description":"Identify remote systems with net.exe querying the Active Directory Domain Computers group.\n\nUpon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the \"Domain Computers\" group. Output will be via stdout.\n","inputs":{},"dependencies":[],"source_definition_sha256":"82c7c76c714b24ecd2c9af14e076e3aeb22d72093bfb5b736cb57d453a64d248"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1018":"/ttp-simulation/techniques/enterprise/T1018/","T1047":"/ttp-simulation/techniques/enterprise/T1047/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1018","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}