1200KM / detection
T1016.001 Internet Connection Discovery — Detection Rules
Detection workspace for T1016.001 Internet Connection Discovery: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0357 Behavioral Detection of Internet Connection Discovery
AN1015 Analytic 1015
Execution of utilities (e.g., ping, tracert, Test-NetConnection) or scripted methods to test Internet connectivity by interacting with external IPs/domains.
AN1016 Analytic 1016
Execution of ping, traceroute, or curl/wget against public IPs/domains to verify Internet reachability.
AN1017 Analytic 1017
Execution of ping, traceroute, or network utility tools to external destinations; may include `scutil` or system_profiler.
AN1018 Analytic 1018
Execution of `ping`, `vmkping`, or `curl` from shell or through automation jobs/scripts to verify Internet egress.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1016.001 simulation workspace
- Command Execution · DC0064
- Network Connection Creation · DC0082
- Process Creation · DC0032
- Script Execution · DC0029
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.