T1016 System Network Configuration Discovery — Detection Rules

Source-backed rule directory

• OpenCanary - SNMP OID Request · test · high · {"category":"application","product":"opencanary"}
• System Network Discovery - Linux · test · informational · {"category":"process_creation","product":"linux"}
• System Network Discovery - macOS · test · informational · {"product":"macos","category":"process_creation"}
• Cisco Discovery · test · low · {"product":"cisco","service":"aaa"}
• Suspicious Network Connection to IP Lookup Service APIs · test · medium · {"category":"network_connection","product":"windows"}
• Firewall Configuration Discovery Via Netsh.EXE · test · low · {"category":"process_creation","product":"windows"}
• Nltest.EXE Execution · test · low · {"category":"process_creation","product":"windows"}
• Potential Recon Activity Via Nltest.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Suspicious Network Command · test · low · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0195 Behavioral Detection of System Network Configuration Discovery

AN0559 Analytic 0559

Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.

AN0560 Analytic 0560

Execution of `ifconfig`, `ip a`, or access to `/proc/net/` indicating collection of local interface and route configuration.

AN0561 Analytic 0561

Execution of `ifconfig`, `networksetup`, or `system_profiler` to query IP/MAC/interface configuration and status.

AN0562 Analytic 0562

Use of `esxcli network` commands (e.g., `esxcli network nic list`, `esxcli network ip interface ipv4 get`) via SSH or hostd to enumerate adapter and IP information.

AN0563 Analytic 0563

CLI-based execution of interface and routing discovery commands (e.g., `show ip interface`, `show arp`, `show route`) over Telnet, SSH, or console.