1200KM / tool
ipconfig — Attack Tool
ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: ipconfig
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Ke3chang · G0004 · Pinned relationship source (relationship--f879eea1-2a05-484d-adbb-c3504813fc5d)
- APT1 · G0006 · Pinned relationship source (relationship--13984eec-6c33-4bab-a22c-5c061ddd6e44)
- APT29 · G0016 · Pinned relationship source (relationship--cb1dab47-1a8e-431c-adc9-51d341ce435e)
- admin@338 · G0018 · Pinned relationship source (relationship--e38e741c-a7ef-420a-911a-1d2cf6abf49d)
- Threat Group-3390 · G0027 · Pinned relationship source (relationship--c354d751-4688-49c5-9f9a-0d2bc705f645)
- OilRig · G0049 · Pinned relationship source (relationship--72d6fe7e-ba33-4117-8153-64226f189ed2)
- APT32 · G0050 · Pinned relationship source (relationship--1c01c64c-8842-44be-bd66-8355eb5d543c)
- Magic Hound · G0059 · Pinned relationship source (relationship--7f32b01c-ecf6-457e-8bca-6c74c02b439e)
- Orangeworm · G0071 · Pinned relationship source (relationship--9878ff64-0206-4a62-a5aa-3f909da87081)
- GALLIUM · G0093 · Pinned relationship source (relationship--058ed2a0-4419-437e-9f3b-4df97f917e8f)
- APT41 · G0096 · Pinned relationship source (relationship--694d94db-3297-4be1-ab01-7b574ee5f4e5)
- HEXANE · G1001 · Pinned relationship source (relationship--bed01612-b213-44dc-aabc-19ea87ef28b8)
- Volt Typhoon · G1017 · Pinned relationship source (relationship--18a2df13-e78e-46ca-9074-17c97d19ad55)
- MirrorFace · G1054 · Pinned relationship source (relationship--660d5be1-468a-4a49-a026-a2da5439c964)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.