T1018 Remote System Discovery — Detection Rules

Source-backed rule directory

• Linux Remote System Discovery · test · low · {"category":"process_creation","product":"linux"}
• Macos Remote System Discovery · test · informational · {"category":"process_creation","product":"macos"}
• Cisco Discovery · test · low · {"product":"cisco","service":"aaa"}
• DirectorySearcher Powershell Exploitation · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Active Directory Computers Enumeration With Get-AdComputer · test · low · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock · experimental · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enable"}
• HackTool - NetExec Execution · experimental · high · {"category":"process_creation","product":"windows"}
• Share And Session Enumeration Using Net.EXE · stable · low · {"category":"process_creation","product":"windows"}
• Nltest.EXE Execution · test · low · {"category":"process_creation","product":"windows"}
• PUA - AdFind Suspicious Execution · test · high · {"category":"process_creation","product":"windows"}
• PUA - Adidnsdump Execution · test · low · {"category":"process_creation","product":"windows"}
• Renamed AdFind Execution · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Scan Loop Network · test · medium · {"category":"process_creation","product":"windows"}
• Chopper Webshell Process Pattern · test · high · {"category":"process_creation","product":"windows"}
• Webshell Hacking Activity Patterns · test · high · {"category":"process_creation","product":"windows"}
• Webshell Detection With Command Line Keywords · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0574 Detection Strategy for Remote System Enumeration Behavior

AN1583 Analytic 1583

Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.

AN1584 Analytic 1584

Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.

AN1585 Analytic 1585

Execution of built-in or AppleScript-based system enumeration via `arp`, `netstat`, `ping`, and discovery of `/etc/hosts` contents.

AN1586 Analytic 1586

ESXi shell or SSH access issuing `esxcli network diag ping` or viewing routing tables to identify connected hosts.

AN1587 Analytic 1587

Execution of discovery commands like `show cdp neighbors`, `show arp`, and other interface-level introspection on Cisco or Juniper devices.