Technique with 2 sub-techniques.View on attack.mitre.org
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface). On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.
Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Rules on DetectionCode tagged with T1016 or one of its sub-techniques.
| Rule | Level | Log source | Technique |
|---|---|---|---|
| OpenCanary - SNMP OID Request | high | opencanary / application | T1016 |
| Potential Recon Activity Via Nltest.EXE | medium | windows / process_creation | T1016 |
| Suspicious Network Connection to IP Lookup Service APIs | medium | windows / network_connection | T1016 |
| Cisco Discovery | low | cisco / NULL | T1016 |
| Firewall Configuration Discovery Via Netsh.EXE | low | windows / process_creation | T1016 |
| Nltest.EXE Execution | low | windows / process_creation | T1016 |
| Suspicious Network Command | low | windows / process_creation | T1016 |
| System Network Discovery - Linux | informational | linux / process_creation | T1016 |
| System Network Discovery - macOS | informational | macos / process_creation | T1016 |
| Rule | Type | Risk | Data source | Technique |
|---|---|---|---|---|
| Cisco IOS XE Reconnaissance Command Activity | Anomaly | NULL | Cisco IOS Logs | T1016 |
| Cisco NVM - Suspicious Network Connection to IP Lookup Service API | Anomaly | NULL | Cisco Network Visibility Module Flow Data | T1016 |
| Detect processes used for System Network Configuration Discovery | TTP | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 | T1016 |
| Linux Auditd System Network Configuration Discovery | Anomaly | NULL | Linux Auditd Syscall | T1016 |
| Linux System Network Discovery | Anomaly | NULL | Sysmon for Linux EventID 1, Osquery Results | T1016 |
| MacOS List Firewall Rules | Anomaly | NULL | Osquery Results | T1016 |
| Network Discovery Using Route Windows App | Hunting | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 | T1016.001 |
| Potential System Network Configuration Discovery Activity | Anomaly | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 | T1016 |
| Windows Common Abused Cmd Shell Risk Behavior | Correlation | NULL | T1016 | |
| Windows Post Exploitation Risk Behavior | Correlation | NULL | T1016 | |
| Windows PowerShell Invoke-RestMethod IP Information Collection | Anomaly | NULL | Powershell Script Block Logging 4104 | T1016 |
| Windows System Network Config Discovery Display DNS | Anomaly | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 | T1016 |
| Windows WinPEAS PowerShell Script Execution | TTP | NULL | Powershell Script Block Logging 4104 | T1016 |
| Used by | Procedure example |
|---|---|
| Groupadmin@338 | admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: |
| GroupAPT1 | APT1 used the |
| GroupAPT19 | APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine. |
| GroupAPT3 | A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway. |
| GroupAPT32 | APT32 used the |
| GroupAPT41 | APT41 collected MAC addresses from victim machines. |
| GroupAPT42 | APT42 has used malware, such as GHAMBAR and POWERPOST, to collect network information. |
| GroupBlackByte | BlackByte used tools such as Arp to pull system network information and identify connected devices. |
| Used by | Procedure example |
|---|---|
| MalwareAction RAT | Action RAT has the ability to collect the MAC address of an infected host. |
| ToolAdFind | AdFind can extract subnet information from Active Directory. |
| MalwareAgent Tesla | Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings. |
| MalwareAgent.btz | Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file. |
| MalwareAmadey | Amadey can identify the IP address of a victim machine. |
| MalwareAnchor | Anchor can determine the public IP and location of a compromised host. |
| MalwareAppleSeed | AppleSeed can identify the IP of a targeted system. |
| MalwareAria-body | Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host. |
View all 232 software examples
| Used by | Procedure example |
|---|---|
| Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries gathered network configuration details utilizing `arp -a` and `nslookup` commands. |
| CampaignAnthropic AI-orchestrated Campaign | During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices. |
| CampaignC0015 | During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host. |
| CampaignC0017 | During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery. |
| CampaignC0018 | During C0018, the threat actors ran `nslookup` and Advanced IP Scanner on the target network. |
| CampaignFrankenstein | During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system. |
| CampaignFunnyDream | During FunnyDream, the threat actors used ipconfig for discovery on remote systems. |
| CampaignKV Botnet Activity | KV Botnet Activity gathers victim IP information during initial installation stages. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
