1200KM / tool
netstat — Attack Tool
netstat is an operating system utility that displays active TCP connections, listening ports, and network statistics.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: netstat
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Ke3chang · G0004 · Pinned relationship source (relationship--325ccde0-2d5a-4306-9c4e-e1a554ee0d87)
- Turla · G0010 · Pinned relationship source (relationship--3643f451-322d-4f38-91a4-00a55a42c7f5)
- admin@338 · G0018 · Pinned relationship source (relationship--d75ee2bd-801c-4521-8d70-f5e2d64c87f9)
- Threat Group-3390 · G0027 · Pinned relationship source (relationship--8b38c61f-d128-4496-a15f-c91d121b39f6)
- OilRig · G0049 · Pinned relationship source (relationship--5744b31d-6633-44ca-8170-17489fec124c)
- Orangeworm · G0071 · Pinned relationship source (relationship--3d988f8f-2448-409c-ac41-4a507bb8cf23)
- APT41 · G0096 · Pinned relationship source (relationship--3f27ef2a-48e8-4d37-8618-fe61dfcafd3e)
- HEXANE · G1001 · Pinned relationship source (relationship--14080577-f5de-46fd-b363-e3f4b4e73495)
- Volt Typhoon · G1017 · Pinned relationship source (relationship--e1a885f7-b364-4f39-a15c-37dd59b9be7e)
- ToddyCat · G1022 · Pinned relationship source (relationship--8b55c302-7e18-4727-a27d-6e4f0b3cecd6)
- APT5 · G1023 · Pinned relationship source (relationship--eef3ac92-4c31-4401-84fe-b6e298610ed9)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.