1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / simulation

T1016 System Network Configuration Discovery — Attack Simulation

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route. Adversaries may also leverage a Network Device CLI on network devices to gather information about…

Complete technique description

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.

Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>).[US-CERT-TA18-106A][Mandiant APT41 Global Intrusion ] On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.[Trellix Rnasomhouse 2024]

Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

Official technique definition · Open in the interactive matrix

Parent and sub-techniques

Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.

Detection telemetry and configuration

These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.

Command Execution · source-mapped

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

  • Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
  • Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
  • On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

Process Creation · source-mapped

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

  • Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
  • Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
  • Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.
  • On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
  • Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
  • For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

Detection rules and analytic guidance

Open the dedicated detection workspace · Existing query engineering

DET0195 Behavioral Detection of System Network Configuration Discovery

MITRE detection strategy

AN0559 Analytic 0559

Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.

Platforms: Windows.

AN0560 Analytic 0560

Execution of `ifconfig`, `ip a`, or access to `/proc/net/` indicating collection of local interface and route configuration.

Platforms: Linux.

AN0561 Analytic 0561

Execution of `ifconfig`, `networksetup`, or `system_profiler` to query IP/MAC/interface configuration and status.

Platforms: macOS.

AN0562 Analytic 0562

Use of `esxcli network` commands (e.g., `esxcli network nic list`, `esxcli network ip interface ipv4 get`) via SSH or hostd to enumerate adapter and IP information.

Platforms: ESXi.

AN0563 Analytic 0563

CLI-based execution of interface and routing discovery commands (e.g., `show ip interface`, `show arp`, `show route`) over Telnet, SSH, or console.

Platforms: Network Devices.

Source rule directory and observation requirements

9 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

Before treating a rule as coverage

  1. Read the actual condition and logsource; identify attacker-side, victim-side or third-party visibility.
  2. Map native sensor fields, parse times and identities, then compile for the selected backend.
  3. Replay a behavior-positive case, a normal control, an authorized look-alike and a missing-telemetry case.
  4. Record matches and misses with rule version and source events. No match is inconclusive when required telemetry is absent.

Anomaly-based detection

No exact technique-specific Atlas model is present for T1016 in the selected source snapshot. The following is a design worksheet, not a newly validated model.

Anomaly engineering worksheet

Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.

  • Script and command execution: Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility.
  • Endpoint activity: Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity.
  1. Define an entity/peer group and feature; exclude the evaluation period from baseline training.
  2. Use representative normal and maintenance activity. Do not invent a production threshold from a synthetic example.
  3. Evaluate held-out behavior-positive and benign cases; measure false positives, misses and telemetry loss separately.
  4. Keep abnormality separate from maliciousness. Correlate with the behavior-specific source evidence.

Anomaly Detection Atlas · Baseline, validation and blind spots

Attack tools and documented software

Software observed in source procedures

These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.

233 source-documented software associations

Simulation design and documented procedures

Atomic evidence: 10 compatible documented candidates. Live lab status: not run for these imported procedures.

Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.

List Windows Firewall Rules

Enumerates Windows Firewall Rules using netsh.

Upon successful execution, cmd.exe will spawn netsh.exe to list firewall rules. Output will be via stdout.

Pinned Atomic procedure · 038263cb-00f4-4b0a-98ae-0696c67e1752 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Qakbot Recon

A list of commands known to be performed by Qakbot for recon purposes

Pinned Atomic procedure · 121de5c6-5818-4868-b8a7-8fd07c455c1b · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

  • recon_commands: File that houses list of commands to be executed (type path; source default PathToAtomicsFolder\T1016\src\qakbot.bat)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • File to copy must exist on disk at specified location (#{recon_commands})
DNS Server Discovery Using nslookup

Identify System domain dns controller on an endpoint using nslookup ldap query. This tool is being abused by qakbot malware to gather information on the domain
controller of the targeted or compromised host. reference https://securelist.com/qakbot-technical-analysis/103931/

Pinned Atomic procedure · 34557863-344a-468f-808b-a1bfb89b4fa9 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

List Open Egress Ports

This is to test for what ports are open outbound. The technique used was taken from the following blog:
https://www.blackhillsinfosec.com/poking-holes-in-the-firewall-egress-testing-with-allports-exposed/

Upon successful execution, powershell will read top-128.txt (ports) and contact each port to confirm if open or not. Output will be to Desktop\open-ports.txt.

Pinned Atomic procedure · 4b467538-f102-491d-ace7-ed487b853bf5 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

  • output_file: Path of file to write port scan results (type path; source default $env:USERPROFILE\Desktop\open-ports.txt)
  • portfile_url: URL to top-128.txt (type url; source default https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1016/src/top-128.txt)
  • port_file: The path to a text file containing ports to be scanned, one port per line. The default list uses the top 128 ports as defined by Nmap. (type path; source default PathToAtomicsFolder\T1016\src\top-128.txt)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • Test requires #{port_file} to exist
IPv4 Enumeration with GetIpAddrTable

Uses C# P/Invoke to call GetIpAddrTable from iphlpapi.dll to enumerate all IPv4
addresses bound to local interfaces. Adversaries use this API to discover network
configuration and identify multi-homed hosts for lateral movement or pivoting. Used by
Turla in ApolloShadow malware.

Reference: https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/

Pinned Atomic procedure · 7dd47911-b7b9-48c2-bb2c-8e1fad5d6d99 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

System Network Configuration Discovery on Windows

Identify network configuration information

Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.

Pinned Atomic procedure · 970ab6a1-0157-4f3f-9a73-ec4166754b23 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Adfind - Enumerate Active Directory Subnet Objects

Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Subnet Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

Pinned Atomic procedure · 9bb45dd7-c466-4f93-83a1-be30e56033ee · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

  • optional_args: Allows defining arguments to add to the adfind command to tailor it to the specific needs of the environment. Use "-arg" notation to add arguments separated by spaces. (type string; source default )

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • AdFind.exe must exist on disk at specified location (PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe)
System Network Configuration Discovery

Identify network configuration information.
Upon successful execution, sh will spawn multiple commands and output will be via stdout.

Pinned Atomic procedure · c141bbdb-7fca-4254-9fd6-f47e79447e17 · macos, linux · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

  • Check if arp command exists on the machine
System Network Configuration Discovery (TrickBot Style)

Identify network configuration information as seen by Trickbot and described here https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/

Upon successful execution, cmd.exe will spawn `ipconfig /all`, `net config workstation`, `net view /all /domain`, `nltest /domain_trusts`. Output will be via stdout.

Pinned Atomic procedure · dafaf052-5508-402d-bf77-51e0700c02e2 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

List macOS Firewall Rules

"This will test if the macOS firewall is enabled and/or show what rules are configured. Must be run with elevated privileges. Upon successful execution, these commands will output various information about the firewall configuration, including status and specific port/protocol blocks or allows.

Using `defaults`, additional arguments can be added to see filtered details, such as `globalstate` for global configuration (\"Is it on or off?\"), `firewall` for common application allow rules, and `explicitauths` for specific rules configured by the user.

Using `socketfilterfw`, flags such as --getglobalstate or --listapps can be used for similar filtering. At least one flag is required to send parseable output to standard out.

Pinned Atomic procedure · ff1d8c25-2aa4-4f18-a425-fede4a41ee88 · macos · bash.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Technique-specific experiment contract

  1. Choose one procedure implementing T1016 System Network Configuration Discovery; identify the observable behavior in the source definition, not just its tactic.
  2. Record exact target, tool/version, inputs, privileges, network limits and approval. Never run an imported default target automatically.
  3. Enable the collection sources above and verify a benign baseline reaches the detector.
  4. Run only the approved isolated scenario; capture native events and an independent behavior observable.
  5. Evaluate the exact rule/model, restore the lab, and preserve configuration, event hashes, alerts, controls and misses.

Synthetic logs and offline contract check

Download synthetic collection fixture (JSON) · Download the complete engineering workbook

This fixture exercises the listed collection fields. It does not reproduce System Network Configuration Discovery, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.

Not run in this browser. No network scan or attack command is executed by this control.

Validation status and remaining work

Source identity
Joined by exact technique/object IDs against hash-pinned sources.
Collection fixture
Available for offline schema exercises; not attack emulation.
Native telemetry / backend / real attack
Not validated for these imported procedures. Source fidelity and page tests cannot establish sensor or detector effectiveness.

All-page audit and evidence inventory · This page’s machine-readable workbook

Sources and evidence boundaries

Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.

Connected ecosystem references

Linked tags

enterprisecloud-hosted-endpointnetwork-infrastructureonpremvirtualizationESXiLinuxmacOSNetwork DevicesWindowsdiscoveryisolated_authorized_labprocedure_review_requiredtelemetry_configuration_requiredsome_candidates_require_elevation
Atomic candidate documentedtechniquesource_mapped

Source procedure platform / method / executor tags:

windowsautomatedcommand_promptpowershellmacoslinuxshbash

Detection and collection

T1016 detection workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.