T1016 System Network Configuration Discovery — Attack Simulation

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route. Adversaries may also leverage a Network Device CLI on network devices to gather information about…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

List Windows Firewall Rules
windows automated command_prompt
Procedure 038263cb-00f4-4b0a-98ae-0696c67e1752; elevation not declared required; cleanup not declared. Not executed or individually validated.
Qakbot Recon
windows automated command_prompt
Procedure 121de5c6-5818-4868-b8a7-8fd07c455c1b; elevation not declared required; cleanup not declared. Not executed or individually validated.
DNS Server Discovery Using nslookup
windows automated command_prompt
Procedure 34557863-344a-468f-808b-a1bfb89b4fa9; elevation not declared required; cleanup not declared. Not executed or individually validated.
List Open Egress Ports
windows automated powershell
Procedure 4b467538-f102-491d-ace7-ed487b853bf5; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
IPv4 Enumeration with GetIpAddrTable
windows automated powershell
Procedure 7dd47911-b7b9-48c2-bb2c-8e1fad5d6d99; elevation not declared required; cleanup not declared. Not executed or individually validated.
System Network Configuration Discovery on Windows
windows automated command_prompt
Procedure 970ab6a1-0157-4f3f-9a73-ec4166754b23; elevation not declared required; cleanup not declared. Not executed or individually validated.
Adfind - Enumerate Active Directory Subnet Objects
windows automated command_prompt
Procedure 9bb45dd7-c466-4f93-83a1-be30e56033ee; elevation not declared required; cleanup not declared. Not executed or individually validated.
System Network Configuration Discovery
macos linux automated sh
Procedure c141bbdb-7fca-4254-9fd6-f47e79447e17; elevation not declared required; cleanup not declared. Not executed or individually validated.
System Network Configuration Discovery (TrickBot Style)
windows automated command_prompt
Procedure dafaf052-5508-402d-bf77-51e0700c02e2; elevation not declared required; cleanup not declared. Not executed or individually validated.
List macOS Firewall Rules
macos automated bash
Procedure ff1d8c25-2aa4-4f18-a425-fede4a41ee88; elevation required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint network-infrastructure onprem virtualization ESXi Linux macOS Network Devices Windows discovery isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate technique source_mapped

Detection and collection

T1016 detection workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.