T1018 Remote System Discovery

About this technique

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, `esxcli network diag ping`.

Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment.

Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).

Detection rules39

Rules on DetectionCode tagged with T1018.

Sigma16

Rule	Level	Log source
Chopper Webshell Process Pattern	high	windows / process_creation
HackTool - NetExec Execution	high	windows / process_creation
PUA - AdFind Suspicious Execution	high	windows / process_creation
Renamed AdFind Execution	high	windows / process_creation
Webshell Detection With Command Line Keywords	high	windows / process_creation
Webshell Hacking Activity Patterns	high	windows / process_creation
DirectorySearcher Powershell Exploitation	medium	windows / ps_script
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock	medium	windows / ps_script
Suspicious Scan Loop Network	medium	windows / process_creation
Active Directory Computers Enumeration With Get-AdComputer	low	windows / ps_script
Cisco Discovery	low	cisco / NULL
Linux Remote System Discovery	low	linux / process_creation
Nltest.EXE Execution	low	windows / process_creation
PUA - Adidnsdump Execution	low	windows / process_creation
Share And Session Enumeration Using Net.EXE	low	windows / process_creation
Macos Remote System Discovery	informational	macos / process_creation

Splunk23

Rule	Type	Risk	Data source
Cisco IOS XE Remote Access Probe Burst	Anomaly	NULL	Cisco IOS Logs
Cisco Secure Firewall - Blocked Connection	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event
Cisco Secure Firewall - Repeated Blocked Connections	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event
Domain Controller Discovery with Nltest	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Domain Controller Discovery with Wmic	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
GetAdComputer with PowerShell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
GetAdComputer with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104
GetDomainComputer with PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
GetDomainComputer with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104
GetDomainController with PowerShell	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
GetDomainController with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104
GetWmiObject Ds Computer with PowerShell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
GetWmiObject Ds Computer with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104
Remote System Discovery with Adsisearcher	TTP	NULL	Powershell Script Block Logging 4104
Remote System Discovery with Dsquery	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Remote System Discovery with Net	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Remote System Discovery with Wmic	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows AdFind Exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows Get-AdComputer Unconstrained Delegation Discovery	TTP	NULL	Powershell Script Block Logging 4104
Windows Netspy Network Scanner Execution	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows PowerView Constrained Delegation Discovery	TTP	NULL	Powershell Script Block Logging 4104
Windows PowerView Unconstrained Delegation Discovery	TTP	NULL	Powershell Script Block Logging 4104
Windows PsTools Recon Usage	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups41

Show 17 more

Magic Hound Medusa Group menuPass MirrorFace Mustang Panda Naikon Play Rocke Sandworm Team Scattered Spider ShinyHunters Silence Threat Group-3390 ToddyCat Turla Volt Typhoon Wizard Spider

Software54

AdFind Arp Backdoor.Oldrea BADHATCH Bazar BitPaymer Black Basta BlackCat BloodHound CanisterWorm Carbon Cobalt Strike Comnie Conti CrackMapExec Diavol DRATzarus DUSTTRAP Epic Flagpro FunnyDream Gomir Havoc HermeticWizard

Show 30 more

Campaigns9

2015 Ukraine Electric Power Attack 2016 Ukraine Electric Power Attack C0015 FunnyDream Leviathan Australian Intrusions Operation CuckooBees Operation Digital Eye Operation Wocao SolarWinds Compromise

Procedure examples104

Groups41

Used by	Procedure example
GroupAgrius	Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments. Unit42 Agrius 2023
GroupAkira	Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks. Arctic Wolf Akira 2023
GroupAPT3	APT3 has a tool that can detect the existence of remote systems. FireEye Clandestine Fox Symantec Buckeye
GroupAPT32	APT32 has enumerated DC servers using the command `net group "Domain Controllers" /domain`. The group has also used the `ping` command. Cybereason Cobalt Kitty 2017
GroupAPT39	APT39 has used NBTscan and custom tools to discover remote systems. BitDefender Chafer May 2020 FireEye APT39 Jan 2019 Symantec Chafer February 2018
GroupAPT41	APT41 has used MiPing to discover active systems in the victim network. apt41_dcsocytec_dec2022
GroupBlackByte	BlackByte used tools such as Arp to identify remotely-connected devices. FBI BlackByte 2022 Picus BlackByte 2022
GroupBRONZE BUTLER	BRONZE BUTLER typically use `ping` and Net to enumerate systems. Secureworks BRONZE BUTLER Oct 2017

View all 41 groups examples

Software54

Used by	Procedure example
ToolAdFind	AdFind has the ability to query Active Directory for computers. Cybereason Bumblebee August 2022 FireEye FIN6 Apr 2019 FireEye Ryuk and Trickbot January 2019 Red Canary Hospital Thwarted Ryuk October 2020
ToolArp	Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems. Palo Alto ARP TechNet Arp
MalwareBackdoor.Oldrea	Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments. Gigamon Berserk Bear October 2021
MalwareBADHATCH	BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer. BitDefender BADHATCH Mar 2021
MalwareBazar	Bazar can enumerate remote systems using `Net View`. Cybereason Bazar July 2020
MalwareBitPaymer	BitPaymer can use `net view` to discover remote systems. Crowdstrike Indrik November 2018
MalwareBlack Basta	Black Basta can use LDAP queries to connect to AD and iterate over connected workstations. Check Point Black Basta October 2022
MalwareBlackCat	BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks. Microsoft BlackCat Jun 2022

View all 54 software examples

Campaigns9

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets. Charles McLellan March 2016
Campaign2016 Ukraine Electric Power Attack	During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD. Dragos Crashoverride 2018
CampaignC0015	During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration. DFIR Conti Bazar Nov 2021
CampaignFunnyDream	During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks. Bitdefender FunnyDream Campaign November 2020
CampaignLeviathan Australian Intrusions	Leviathan performed extensive remote host enumeration to build their own map of victim networks during Leviathan Australian Intrusions. CISA Leviathan 2024
CampaignOperation CuckooBees	During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance. Cybereason OperationCuckooBees May 2022
CampaignOperation Digital Eye	During Operation Digital Eye, threat actors used Ping for reconnaissance. sentinelone operationDigitalEye Dec 2024
CampaignOperation Wocao	During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory. FoxIT Wocao December 2019

View all 9 campaigns examples

References2

CISA AR21-126A FIVEHANDS May 2021 Open source
CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
US-CERT-TA18-106A Open source
US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.