T1016

System Network Configuration Discovery

Discovery Last updated:

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information, including ipconfig/ifconfig, arp, nbtstat, route, and netstat. Adversaries use this information during automated discovery to shape follow-on behaviors, including determining access within the target network and planning lateral movement paths. On ESXi hosts, esxcli commands such as 'esxcli network nic list' and 'esxcli network ip interface ipv4 get' are used. Network device CLIs may also be leveraged (e.g., 'show ip route', 'show ip interface'). Threat actors including Mustang Panda, HEXANE, and malware families such as Pikabot, Dyre, and Olympic Destroyer routinely perform this technique as part of initial reconnaissance after compromise.

What is T1016 System Network Configuration Discovery?

System Network Configuration Discovery (T1016) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for System Network Configuration Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated low severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1016 System Network Configuration Discovery
Canonical reference
https://attack.mitre.org/techniques/T1016/
Microsoft Sentinel / Defender
kusto 
let NetworkDiscoveryBinaries = dynamic([
  "ipconfig.exe", "arp.exe", "nbtstat.exe", "route.exe", "netstat.exe",
  "netsh.exe", "hostname.exe", "tracert.exe", "pathping.exe"
]);
let NetworkDiscoveryKeywords = dynamic([
  "ipconfig", "ifconfig", "ip addr", "ip route", "ip link",
  "arp -a", "arp -n", "netstat -r", "route print", "nbtstat",
  "netsh interface", "Get-NetIPConfiguration", "Get-NetAdapter",
  "Get-NetRoute", "Get-DnsClientServerAddress", "gwmi Win32_NetworkAdapterConfiguration",
  "Win32_NetworkAdapter", "esxcli network", "show ip route", "show ip interface",
  "networksetup", "system_profiler SPNetworkDataType"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    FileName in~ (NetworkDiscoveryBinaries)
    or (FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "python.exe", "python3.exe")
        and ProcessCommandLine has_any (NetworkDiscoveryKeywords))
  )
| extend IsNativeDiscoveryTool = FileName in~ (NetworkDiscoveryBinaries)
| extend IsScriptedDiscovery = FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| extend SuspiciousParent = InitiatingProcessFileName in~ (
    "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
    "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe",
    "regsvr32.exe", "msiexec.exe", "svchost.exe"
  )
| extend CommandArgs = ProcessCommandLine
| project Timestamp, DeviceName, AccountName, AccountDomain,
    FileName, ProcessCommandLine, InitiatingProcessFileName,
    InitiatingProcessCommandLine, InitiatingProcessAccountName,
    IsNativeDiscoveryTool, IsScriptedDiscovery, SuspiciousParent
| sort by Timestamp desc

Detects system network configuration discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors execution of native network enumeration utilities (ipconfig.exe, arp.exe, nbtstat.exe, route.exe, netstat.exe, netsh.exe) as well as scripted equivalents via PowerShell WMI queries (Win32_NetworkAdapterConfiguration, Get-NetIPConfiguration, Get-NetAdapter). Flags executions originating from Office applications, script interpreters, or other suspicious parent processes that indicate post-exploitation discovery rather than administrative activity.

low severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • System administrators and helpdesk staff running ipconfig, arp, or netstat during routine troubleshooting
  • IT monitoring agents (SolarWinds, PRTG, Nagios, Datadog) that enumerate network interfaces and routing tables on a schedule
  • Software installers and configuration management tools (SCCM, Ansible, Puppet, Chef) that query network settings to configure applications
  • Security scanners and vulnerability assessment tools that collect host network configuration as part of asset inventory
  • Developer workstations where developers routinely use PowerShell Get-NetIPConfiguration or ip addr for network testing

Sigma rule & cross-platform mapping

The detection logic for System Network Configuration Discovery (T1016) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1016 Sigma rules on detection.fyi

Platform-specific guides for T1016

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (11)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Windows Network Configuration Enumeration via ipconfig

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'ipconfig /all'. Sysmon Event ID 11: File Create at %TEMP%\netconfig.txt. Security Event ID 4688 (if command line auditing enabled) showing cmd.exe spawning ipconfig.exe. Prefetch file IPCONFIG.EXE-*.pf updated.

  2. Test 2ARP Table and Routing Table Bulk Enumeration

    Expected signal: Sysmon Event ID 1: Four separate Process Create events for arp.exe, route.exe, netstat.exe, and nbtstat.exe within seconds of each other, all with parent process cmd.exe. Security Event ID 4688 for each child process. Prefetch files for each tool updated.

  3. Test 3PowerShell WMI Network Adapter Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_NetworkAdapterConfiguration'. PowerShell ScriptBlock Log Event ID 4104 with full script content. WMI Activity Event in Microsoft-Windows-WMI-Activity/Operational. No ipconfig.exe or arp.exe child process spawned — purely in-process WMI query.

  4. Test 4PowerShell Get-NetIPConfiguration and Get-NetAdapter Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-NetIPConfiguration', 'Get-NetAdapter', and 'Get-NetRoute'. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet sequence. No child processes spawned. Microsoft-Windows-WMI-Activity/Operational may log underlying WMI calls made by these cmdlets.

  5. Test 5Linux Network Configuration Discovery via ip and arp

    Expected signal: Linux auditd SYSCALL records for execve() calls for ip, arp, and cat with their arguments. Syslog process accounting entries. If auditd is configured with -a exit,always -F arch=b64 -S execve rules, EXECVE records show each command. /proc audit trail for process creation.

Response Playbook

Triage

  1. Identify the parent process — was the discovery tool spawned by an Office application (winword.exe, excel.exe), a browser, mshta.exe, or wscript.exe? This indicates a malicious macro or script dropper initiated discovery.
  2. Check the user account context — is this a service account, domain admin, or a standard user on a workstation? Privileged accounts running discovery tools outside a known change window are suspicious.
  3. Review the sequence of events — is this one ipconfig command, or are multiple discovery commands (ipconfig, arp, netstat, route, nbtstat) being executed in rapid succession within a short time window? Bulk discovery is a strong indicator of automated post-exploitation.
  4. Check the initiating process command line — was ipconfig or arp called from inside a PowerShell one-liner, a cmd /c inline string, or a script running from %TEMP% or an AppData subdirectory?
  5. Cross-reference with other discovery techniques — has this host also run process enumeration (tasklist), user discovery (net user, whoami), or share enumeration (net view, net share) recently? Discovery chaining is characteristic of post-exploitation frameworks.
  6. Review the timing — did this occur immediately after a suspicious logon, a new process injected into a host process, or following an email delivered to this user?

Containment

  1. If a suspicious parent (Office, mshta, wscript) spawned the discovery tool: isolate the endpoint immediately via EDR network isolation and begin malware triage on the originating process and any files it wrote.
  2. If a command-and-control callback is identified concurrent with or following the discovery activity: block the C2 IP/domain at the perimeter firewall and DNS layer, and isolate the host.
  3. If a service account is being used for discovery across multiple hosts: disable the service account in Active Directory immediately, rotate its password, and review what systems it has access to.
  4. If lateral movement indicators are present following the discovery: reset credentials for any accounts whose hashes or tokens may have been accessible on the compromised host, and place additional monitoring on adjacent network segments identified in the discovered routing table.
  5. If the host is a server (domain controller, file server, database server): treat as high severity — escalate immediately, isolate if any follow-on activity is detected, and preserve the system image for forensic analysis.

Evidence Collection

  1. Process Creation logs — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing) showing the full command lines of discovery tools executed, their parent processes, and timestamps.
  2. PowerShell ScriptBlock Logging (Event ID 4104) — captures full WMI queries and Get-Net* cmdlet calls that enumerate network configuration via script.
  3. Network Connection logs — Sysmon Event ID 3 for any outbound connections made immediately after discovery commands, which may indicate C2 check-in with collected network data.
  4. File Creation logs — Sysmon Event ID 11 for any files written to disk (e.g., output redirected to a file: ipconfig /all > %TEMP%\info.txt) that may be staged for exfiltration.
  5. Prefetch files — C:\Windows\Prefetch\IPCONFIG.EXE-*.pf, ARP.EXE-*.pf, NBTSTAT.EXE-*.pf — confirm execution and provide timestamps even if logs are missing.
  6. Windows Event Log — Security Event ID 4688 with process command line auditing enabled (Computer Configuration > Policies > Administrative Templates > System > Audit Process Creation).
  7. ARP cache snapshot — run 'arp -a' and 'netstat -r' at time of collection to document current network state and compare with what an adversary may have captured.
  8. Memory dump of any suspicious process that spawned the discovery activity — may contain collected network data and C2 communication buffers.

Escalation Criteria

  • ! Network discovery tool spawned directly by an Office application, browser, or known LOLBin (mshta, wscript, rundll32) — indicates active exploitation.
  • ! Discovery commands executed in rapid sequence (5+ network/system discovery commands within 60 seconds) — indicates automated post-exploitation framework activity.
  • ! Discovery activity on a domain controller, identity provider, or critical infrastructure host — the network configuration of these systems is high-value targeting information.
  • ! Evidence that discovered network configuration data was written to a file and subsequently accessed by a process with outbound network connections — indicates staging for exfiltration.
  • ! Discovery activity correlating with a newly created or newly active service, scheduled task, or process injection event — indicates the discovery is part of a persistent implant's reconnaissance routine.
  • ! Same pattern of discovery commands observed across multiple hosts within a short time window — indicates automated lateral movement where each newly compromised host performs identical enumeration.

Investigation Guide

Forensic Artifacts

  • > Prefetch files: C:\Windows\Prefetch\IPCONFIG.EXE-*.pf, ARP.EXE-*.pf, NBTSTAT.EXE-*.pf, ROUTE.EXE-*.pf, NETSTAT.EXE-*.pf — confirm execution timestamps even if event logs are cleared.
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — if discovery commands were run via the Run dialog.
  • > PowerShell history: $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — may contain Get-NetIPConfiguration, Get-NetAdapter, or WMI network queries.
  • > Temp directory artifacts: %TEMP%\*.txt or %TEMP%\*.log — adversaries commonly redirect ipconfig /all output to a temp file for staging.
  • > Windows Event Log: Security Event ID 4688 (Process Creation with command line) or Sysmon Event ID 1 — primary source for command execution evidence.
  • > Sysmon Event ID 11 (File Create): any files written to %TEMP%, %APPDATA%, or unusual directories by cmd.exe or powershell.exe following discovery commands.
  • > ARP cache (%SystemRoot%\System32\arp.exe -a): represents the current neighbor table and reveals which hosts the compromised system has recently communicated with.
  • > WMI activity logs: Microsoft-Windows-WMI-Activity/Operational — captures WMI provider queries including Win32_NetworkAdapterConfiguration enumeration.

Tuning Guidance

Network configuration discovery is one of the highest-volume false-positive techniques to tune. Start by building an allowlist of known-good parent processes per environment: monitoring agents (nsclient.exe, SolarWindsAgent.exe, datadogagent.exe, prtgprobe.exe) that legitimately run ipconfig or netstat on a schedule should be excluded by initiating process name combined with the monitoring service account. SCCM and Intune deployment scripts frequently run netsh and ipconfig during application installs — exclude by combining the SCCM service account (CM_NAA, domain join accounts) with known parent processes (ccmexec.exe, CcmSetup.exe). The highest-confidence detections are those where a discovery tool is launched by an Office application, browser, or script host — these should never be excluded. Consider raising alert priority for: (1) 3+ distinct tools used within 5 minutes, (2) any discovery from an Office or browser parent, (3) output redirection to a file (look for '>' or 'Out-File' in command line), (4) discovery commands on servers rather than workstations. On Linux endpoints, tune around configuration management tools (Ansible, Puppet, Chef) that routinely call 'ip addr show' and 'ip route show' as part of inventory collection — exclude by the service account used.

Hunting Queries

Hunt for hosts or users executing three or more distinct network discovery utilities, or five or more total executions, within a 5-minute window. This burst pattern distinguishes automated post-exploitation discovery (common in frameworks like Cobalt Strike, Metasploit, Empire) from legitimate one-off administrative use of ipconfig or arp.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("ipconfig.exe", "arp.exe", "nbtstat.exe", "route.exe", "netstat.exe", "netsh.exe")
| summarize
    CommandsRun = count(),
    ToolsUsed = make_set(FileName),
    UniqueTools = dcount(FileName),
    Commands = make_set(ProcessCommandLine),
    Earliest = min(Timestamp),
    Latest = max(Timestamp)
  by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 5m)
| where UniqueTools >= 3 or CommandsRun >= 5
| sort by CommandsRun desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\ipconfig.exe" OR Image="*\\arp.exe" OR Image="*\\nbtstat.exe"
   OR Image="*\\route.exe" OR Image="*\\netstat.exe" OR Image="*\\netsh.exe")
| bin _time span=5m
| stats count as CommandsRun, dc(Image) as UniqueTools, values(Image) as ToolsUsed,
        values(CommandLine) as Commands by host, User, ParentImage, _time
| where UniqueTools >= 3 OR CommandsRun >= 5
| sort - CommandsRun

Hunt for network configuration discovery utilities spawned directly by Office applications, browsers, or known LOLBins. Any instance of ipconfig, arp, or nbtstat being called by winword.exe, excel.exe, mshta.exe, or wscript.exe is a high-fidelity indicator of malicious macro or script execution performing post-exploitation reconnaissance.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("ipconfig.exe", "arp.exe", "nbtstat.exe", "route.exe", "netstat.exe")
| where InitiatingProcessFileName in~ (
    "winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
    "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe",
    "regsvr32.exe", "msiexec.exe"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\ipconfig.exe" OR Image="*\\arp.exe" OR Image="*\\nbtstat.exe"
   OR Image="*\\route.exe" OR Image="*\\netstat.exe")
  (ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\powerpnt.exe"
   OR ParentImage="*\\outlook.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\wscript.exe"
   OR ParentImage="*\\cscript.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\regsvr32.exe")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Hunt for PowerShell-based network discovery using WMI class queries (Win32_NetworkAdapterConfiguration, Win32_NetworkAdapter) and native PowerShell networking cmdlets (Get-NetIPConfiguration, Get-NetAdapter, Get-NetRoute). These scripted methods are used by post-exploitation frameworks to collect network configuration programmatically without spawning obvious child processes, making them harder to detect than direct ipconfig execution.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName in~ ("powershell.exe", "pwsh.exe")
    and ProcessCommandLine has_any (
      "Win32_NetworkAdapterConfiguration", "Win32_NetworkAdapter",
      "Get-NetIPConfiguration", "Get-NetAdapter", "Get-NetRoute",
      "Get-DnsClientServerAddress", "Get-NetConnectionProfile"
    ))
| extend IsWMIQuery = ProcessCommandLine has "Win32_Network"
| extend IsCmdletQuery = ProcessCommandLine has_any ("Get-Net", "Get-Dns")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    IsWMIQuery, IsCmdletQuery
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\powershell.exe"
  (CommandLine="*Win32_NetworkAdapterConfiguration*" OR CommandLine="*Win32_NetworkAdapter*"
   OR CommandLine="*Get-NetIPConfiguration*" OR CommandLine="*Get-NetAdapter*"
   OR CommandLine="*Get-NetRoute*" OR CommandLine="*Get-DnsClientServerAddress*"
   OR CommandLine="*Get-NetConnectionProfile*")
| eval IsWMIQuery=if(match(CommandLine, "Win32_Network"), 1, 0)
| eval IsCmdletQuery=if(match(CommandLine, "Get-Net|Get-Dns"), 1, 0)
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine, IsWMIQuery, IsCmdletQuery
| sort - _time

Atomic Red Team Tests

Test 1 Windows Network Configuration Enumeration via ipconfig
windows

Executes ipconfig /all to collect full network adapter configuration including IP addresses, MAC addresses, DNS servers, DHCP settings, and default gateways. This is the most common single command used by adversaries and malware families (Pikabot, Dyre, Mustang Panda) to quickly profile a compromised host's network environment.

Command

powershell 
cmd.exe /c ipconfig /all > %TEMP%\netconfig.txt & type %TEMP%\netconfig.txt

Cleanup

powershell 
del %TEMP%\netconfig.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'ipconfig /all'. Sysmon Event ID 11: File Create at %TEMP%\netconfig.txt. Security Event ID 4688 (if command line auditing enabled) showing cmd.exe spawning ipconfig.exe. Prefetch file IPCONFIG.EXE-*.pf updated.

Expected Detection

KQL: FileName=~'ipconfig.exe' fires. SPL: Image matching '*\\ipconfig.exe' fires. Both detections flag IsNativeTool=1.

Test 2 ARP Table and Routing Table Bulk Enumeration
windows

Simulates the network discovery pattern used by post-exploitation frameworks (Cobalt Strike, Empire, Metasploit) that run multiple discovery commands in rapid succession. Executes arp -a (ARP neighbor table), route print (routing table), and netstat -r (routing interface list) to map the local network topology.

Command

powershell 
cmd.exe /c arp -a && route print && netstat -r && nbtstat -n

Expected Telemetry

Sysmon Event ID 1: Four separate Process Create events for arp.exe, route.exe, netstat.exe, and nbtstat.exe within seconds of each other, all with parent process cmd.exe. Security Event ID 4688 for each child process. Prefetch files for each tool updated.

Expected Detection

KQL: Hunting query fires — UniqueTools >= 3 within 5-minute window. SPL: Stats query shows dc(Image) >= 3. Main detection fires for each individual tool execution. The burst pattern is the key escalation indicator.

Test 3 PowerShell WMI Network Adapter Enumeration
windows

Uses PowerShell to query WMI Win32_NetworkAdapterConfiguration for full network configuration including IP address, MAC address, DNS servers, DHCP settings, and gateway. This scripted approach is used by malware and post-exploitation frameworks to avoid spawning obvious cmd.exe child processes, making it less visible to defenders monitoring for ipconfig.exe execution.

Command

powershell 
powershell.exe -NoProfile -Command "Get-WmiObject Win32_NetworkAdapterConfiguration | Where-Object { $_.IPEnabled } | Select-Object Description, MACAddress, IPAddress, DefaultIPGateway, DNSServerSearchOrder | Format-List"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_NetworkAdapterConfiguration'. PowerShell ScriptBlock Log Event ID 4104 with full script content. WMI Activity Event in Microsoft-Windows-WMI-Activity/Operational. No ipconfig.exe or arp.exe child process spawned — purely in-process WMI query.

Expected Detection

KQL: IsScriptedDiscovery=true fires on the PowerShell+WMI hunting query. SPL: IsScriptedDiscovery=1, SuspicionScore=1. Main detection fires because ProcessCommandLine has 'Win32_NetworkAdapterConfiguration'.

Test 4 PowerShell Get-NetIPConfiguration and Get-NetAdapter Enumeration
windows

Uses modern PowerShell networking cmdlets to enumerate all network adapters, IP addresses, and routing information. These cmdlets (introduced in Windows Server 2012 / Windows 8) are preferred by post-exploitation frameworks and PowerShell-native malware over WMI queries because they produce structured objects. Covers Get-NetIPConfiguration (full adapter config), Get-NetAdapter (physical adapter details including MAC), and Get-NetRoute (routing table).

Command

powershell 
powershell.exe -NoProfile -Command "Get-NetIPConfiguration; Get-NetAdapter | Select-Object Name, MacAddress, Status; Get-NetRoute | Select-Object DestinationPrefix, NextHop, RouteMetric"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-NetIPConfiguration', 'Get-NetAdapter', and 'Get-NetRoute'. PowerShell ScriptBlock Log Event ID 4104 with full cmdlet sequence. No child processes spawned. Microsoft-Windows-WMI-Activity/Operational may log underlying WMI calls made by these cmdlets.

Expected Detection

KQL: IsScriptedDiscovery=true fires; hunting query for Get-NetIPConfiguration fires. SPL: IsScriptedDiscovery=1, IsCmdletQuery=1. The compound cmdlet chain is flagged by the Get-Net* hunting query.

Test 5 Linux Network Configuration Discovery via ip and arp
linux

Simulates the Linux equivalent of Windows network discovery used by threat actors and malware on Linux endpoints. Executes ip addr show (all interface addresses including MAC), ip route show (routing table), and arp -n (ARP neighbor table) — the modern equivalents of ifconfig and route. These are used by implants targeting Linux servers and containers.

Command

bash 
ip addr show && ip route show && arp -n && cat /etc/resolv.conf

Expected Telemetry

Linux auditd SYSCALL records for execve() calls for ip, arp, and cat with their arguments. Syslog process accounting entries. If auditd is configured with -a exit,always -F arch=b64 -S execve rules, EXECVE records show each command. /proc audit trail for process creation.

Expected Detection

SPL: syslog or linux_secure sourcetype showing ip addr, ip route, arp -n, and cat /etc/resolv.conf executed by the same user in rapid succession. Linux auditd rules matching EXECVE syscalls for these binaries.

Related Detections

Tactic Hub

TA0007Discovery

Sub-techniques (2)

Related Techniques

T1016.001Internet Connection DiscoveryT1016.002Wi-Fi DiscoveryT1049System Network Connections DiscoveryT1018Remote System DiscoveryT1046Network Service DiscoveryT1057Process DiscoveryT1082System Information DiscoveryT1087Account DiscoveryT1071.001Web ProtocolsT1074.001Local Data Staging

Same Tactic: Discovery

Popular Detections