T1049 System Network Connections Discovery — Detection Rules

Source-backed rule directory

• System Network Connections Discovery - Linux · test · low · {"category":"process_creation","product":"linux"}
• System Network Connections Discovery - MacOs · test · informational · {"category":"process_creation","product":"macos"}
• Cisco Discovery · test · low · {"product":"cisco","service":"aaa"}
• Use Get-NetTCPConnection · test · low · {"product":"windows","category":"ps_classic_start"}
• Use Get-NetTCPConnection - PowerShell Module · test · low · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• HackTool - SharpView Execution · test · high · {"category":"process_creation","product":"windows"}
• System Network Connections Discovery Via Net.EXE · test · low · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0320 Detection of System Network Connections Discovery Across Platforms

AN0903 Analytic 0903

Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.

AN0904 Analytic 0904

Detects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.

AN0905 Analytic 0905

Detects shell-based enumeration of active connections using `netstat`, `lsof -i`, or AppleScript-based system discovery.

AN0906 Analytic 0906

Detects shell or API usage of `esxcli network ip connection list` or `netstat` to enumerate ESXi host connections.

AN0907 Analytic 0907

Detects interactive or automated use of CLI commands like `show ip sockets`, `show tcp brief`, or SNMP queries for active sessions on routers/switches.

AN0908 Analytic 0908

Detects enumeration of cloud network interfaces, VPCs, subnets, or peer connections using CLI or SDKs (e.g., AWS CLI, Azure CLI, GCloud CLI).