Which SIEM platforms have a T1018 detection rule?

df00tech provides T1018 (Remote System Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1018 detection?

The T1018 detection is rated medium severity with medium confidence.

What are common false positives for T1018?

Common false positives for T1018 include: IT helpdesk and system administrators running net view or ping sweeps for legitimate troubleshooting; Network monitoring tools (PRTG, SolarWinds, Nagios, Zabbix) that periodically ping or enumerate hosts; Software deployment systems (SCCM, Ansible, Puppet) that query AD for computer objects via Get-ADComputer.

T1018

Remote System Discovery

Q: What data sources are required to detect Remote System Discovery (T1018)?

Detecting Remote System Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, File: File Access, Microsoft Defender for Endpoint.

Discovery Last updated: April 16, 2026

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Common methods include net view, ping sweeps, ARP cache enumeration, NBT/NetBIOS scanning, and third-party tools such as Nmap, MASSCAN, NBTscan, and Angry IP Scanner. Adversaries may also read local host files (C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or query Active Directory for computer objects. On ESXi hosts, esxcli commands may be used to enumerate network peers.

What is T1018 Remote System Discovery?

Remote System Discovery (T1018) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Remote System Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, File: File Access, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Discovery
Technique: T1018 Remote System Discovery
Canonical reference: https://attack.mitre.org/techniques/T1018/

Microsoft Sentinel / Defender

kusto

let NetworkDiscoveryProcesses = dynamic(["net.exe", "net1.exe", "ping.exe", "arp.exe", "nbtstat.exe", "nltest.exe", "nmap", "masscan", "nbtscan", "ipscan"]);
let SuspiciousCommandPatterns = dynamic(["net view", "net1 view", "/domain", "net group", "nltest /dclist", "nltest /dsgetdc", "nltest /domain_trusts", "arp -a", "nbtstat -A", "nbtstat -a"]);
let PingSweepPattern = dynamic(["-n 1", "/c ping", "for /l", "1..254", "Test-Connection", "Test-NetConnection", "System.Net.NetworkInformation.Ping"]);
// Branch 1: Known network discovery tools and commands
let Branch1 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (NetworkDiscoveryProcesses)
    or ProcessCommandLine has_any (SuspiciousCommandPatterns)
| extend DiscoveryType = case(
    ProcessCommandLine has "net view" or ProcessCommandLine has "net1 view", "NetView",
    ProcessCommandLine has "nltest", "DomainDiscovery",
    ProcessCommandLine has "arp -a" or ProcessCommandLine has "arp /a", "ARPCache",
    ProcessCommandLine has "nbtstat", "NetBIOS",
    FileName =~ "ping.exe" and ProcessCommandLine has_any ("-n 1", "/c"), "PingSweep",
    FileName =~ "nmap" or FileName =~ "masscan" or FileName =~ "nbtscan", "ExternalScanner",
    "Other"
  );
// Branch 2: PowerShell-based ping sweeps and AD computer enumeration
let Branch2 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PingSweepPattern)
    or ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer", "Invoke-Portscan", "netscan", "NetworkInformation.Ping", "Resolve-DnsName", "[Net.Dns]::GetHostEntry", "ping -n 1")
| extend DiscoveryType = case(
    ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer"), "ADComputerEnum",
    ProcessCommandLine has_any ("NetworkInformation.Ping", "Test-Connection", "Test-NetConnection"), "PSPingSweep",
    ProcessCommandLine has_any ("Invoke-Portscan", "netscan"), "PSPortScan",
    "PSNetworkDiscovery"
  );
// Branch 3: hosts file access (passive discovery)
let Branch3 = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ @"C:\Windows\System32\drivers\etc"
| where FileName =~ "hosts"
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "csrss.exe")
| extend DiscoveryType = "HostsFileAccess";
union Branch1, Branch2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DiscoveryType
| sort by Timestamp desc

Detects remote system discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents and DeviceFileEvents tables. Covers three branches: (1) native Windows tools such as net view, nltest, arp, nbtstat, and third-party scanners; (2) PowerShell-based techniques including Get-ADComputer, System.Net.NetworkInformation.Ping ping sweeps, Test-Connection, and PowerView's Get-NetComputer; (3) hosts file reads by unexpected processes. DiscoveryType field categorises the method for analyst triage.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution File: File Access Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

IT helpdesk and system administrators running net view or ping sweeps for legitimate troubleshooting
Network monitoring tools (PRTG, SolarWinds, Nagios, Zabbix) that periodically ping or enumerate hosts
Software deployment systems (SCCM, Ansible, Puppet) that query AD for computer objects via Get-ADComputer
Vulnerability scanning tools (Tenable Nessus, Qualys, Rapid7) running credentialed scans from authorised scanner hosts
Domain controllers running nltest for replication health checks

Splunk

spl

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval Image=coalesce(Image, NewProcessName)
| eval CommandLine=coalesce(CommandLine, ProcessCommandLine)
| eval ParentImage=coalesce(ParentImage, ParentProcessName)
| eval CommandLineLower=lower(CommandLine)
| eval ImageBasename=mvindex(split(Image, "\\"), -1)
// Score network discovery indicators
| eval NetView=if(match(CommandLineLower, "net\s+view|net1\s+view"), 1, 0)
| eval NLTest=if(match(CommandLineLower, "nltest.*(/dclist|/dsgetdc|/domain_trusts|/server)"), 1, 0)
| eval ARPEnum=if(match(CommandLineLower, "arp\s+(-a|/a)"), 1, 0)
| eval NBTStat=if(match(CommandLineLower, "nbtstat\s+(-a|-A|-n|-S)"), 1, 0)
| eval PingSweep=if(match(CommandLineLower, "ping.*-n\s+1|for\s+/l.*ping|ping.*255\.255|masscan|nbtscan"), 1, 0)
| eval PSDiscovery=if(match(CommandLineLower, "get-adcomputer|get-netcomputer|test-connection|test-netconnection|invoke-portscan|networkInformation\.ping|\[net\.dns\]"), 1, 0)
| eval ExternalScanner=if(match(ImageBasename, "nmap\.exe|masscan\.exe|nbtscan\.exe|ipscan\.exe|angryip"), 1, 0)
| eval SuspicionScore=NetView + NLTest + ARPEnum + NBTStat + PingSweep + PSDiscovery + ExternalScanner
| where SuspicionScore > 0
| eval DiscoveryType=case(
    NetView=1, "NetView",
    NLTest=1, "DomainDiscovery",
    ARPEnum=1, "ARPCache",
    NBTStat=1, "NetBIOS",
    PingSweep=1, "PingSweep",
    PSDiscovery=1, "PSNetworkDiscovery",
    ExternalScanner=1, "ExternalScanner",
    true(), "Other"
  )
| table _time, host, User, ImageBasename, CommandLine, ParentImage, DiscoveryType, SuspicionScore, NetView, NLTest, ARPEnum, NBTStat, PingSweep, PSDiscovery, ExternalScanner
| sort - _time

Detects remote system discovery using Sysmon Event ID 1 (Process Create) and Security Event ID 4688 (Process Creation with command line auditing). Evaluates seven discovery method categories and applies a cumulative suspicion score. Covers net view/net1 view domain enumeration, nltest domain trust discovery, ARP cache reading, NetBIOS scanning, ping sweeps, PowerShell-based AD and network enumeration, and external scanning tools like Nmap and MASSCAN.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1 Security Event ID 4688

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

IT helpdesk and system administrators running net view or ping sweeps for legitimate troubleshooting
Network monitoring tools (PRTG, SolarWinds, Nagios, Zabbix) that periodically ping or enumerate hosts
Software deployment systems (SCCM, Ansible, Puppet) that query AD for computer objects via Get-ADComputer
Vulnerability scanning tools (Tenable Nessus, Qualys, Rapid7) running credentialed scans from authorised scanner hosts
Domain controllers running nltest for replication health checks

Elastic Security (EQL)

eql

sequence by host.name with maxspan=5m
  [process where event.type == "start" and (
    process.name in~ ("net.exe", "net1.exe", "ping.exe", "arp.exe", "nbtstat.exe", "nltest.exe", "nmap", "masscan", "nbtscan", "ipscan") or
    (
      process.name in~ ("powershell.exe", "pwsh.exe") and (
        process.args : ("Get-ADComputer", "Get-NetComputer", "Invoke-Portscan", "Test-Connection", "Test-NetConnection", "NetworkInformation.Ping", "Resolve-DnsName", "[Net.Dns]::GetHostEntry") or
        process.command_line : ("*ping -n 1*", "*for /l*", "*1..254*")
      )
    ) or
    (
      process.command_line : ("*net view*", "*net1 view*", "*nltest*/dclist*", "*nltest*/dsgetdc*", "*nltest*/domain_trusts*", "*arp -a*", "*arp /a*", "*nbtstat -A*", "*nbtstat -a*", "*nbtstat -n*", "*nbtstat -S*")
    )
  )]
| where not process.parent.name in~ ("services.exe", "msiexec.exe", "sccm.exe", "ccmexec.exe")
| eval discovery_type = case(
    process.command_line : ("*net view*", "*net1 view*"), "NetView",
    process.command_line : ("*nltest*"), "DomainDiscovery",
    process.command_line : ("*arp -a*", "*arp /a*"), "ARPCache",
    process.command_line : ("*nbtstat*"), "NetBIOS",
    process.command_line : ("*ping*-n 1*", "*masscan*", "*nbtscan*"), "PingSweep",
    process.name in~ ("nmap", "masscan", "nbtscan", "ipscan"), "ExternalScanner",
    process.name in~ ("powershell.exe", "pwsh.exe") and process.command_line : ("*Get-ADComputer*", "*Get-NetComputer*"), "ADComputerEnum",
    process.name in~ ("powershell.exe", "pwsh.exe") and process.command_line : ("*Test-Connection*", "*NetworkInformation.Ping*"), "PSPingSweep",
    "Other"
  )
| keep @timestamp, host.name, user.name, process.name, process.command_line, process.parent.name, process.pid, discovery_type

Detects Remote System Discovery (T1018) via process execution of known network enumeration tools, PowerShell-based ping sweeps and AD computer enumeration, and suspicious command patterns including net view, nltest, arp, nbtstat, and external scanners. Uses ECS process fields and sequences events per host.

medium severity high confidence

Data Sources

Elastic Endpoint Security Windows Event Logs via Winlogbeat Sysmon via Winlogbeat Auditbeat (Linux)

Required Tables

logs-endpoint.events.process-* logs-windows.sysmon_operational-* winlogbeat-*

False Positives

IT administrators running network inventory or asset discovery tools (e.g., Nmap, Angry IP Scanner) during authorized scans
Domain controllers and management systems running nltest, net view, or Get-ADComputer as part of routine health checks or Group Policy processing
Software deployment tools (SCCM, Ansible, Chef) enumerating hosts for patch management or configuration management operations

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  "Process Name" AS process_name,
  "CommandLine" AS command_line,
  "ParentCommandLine" AS parent_command_line,
  CASE
    WHEN LOWER("CommandLine") IMATCHES '.*net[\s]+view.*|.*net1[\s]+view.*' THEN 'NetView'
    WHEN LOWER("CommandLine") IMATCHES '.*nltest.*(dclist|dsgetdc|domain_trusts).*' THEN 'DomainDiscovery'
    WHEN LOWER("CommandLine") IMATCHES '.*arp[\s]+(-a|/a).*' THEN 'ARPCache'
    WHEN LOWER("CommandLine") IMATCHES '.*nbtstat[\s]+(-a|-A|-n|-S).*' THEN 'NetBIOS'
    WHEN LOWER("CommandLine") IMATCHES '.*ping.*-n[\s]+1.*|.*masscan.*|.*nbtscan.*' THEN 'PingSweep'
    WHEN LOWER("CommandLine") IMATCHES '.*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|networkInformation\.ping).*' THEN 'PSNetworkDiscovery'
    WHEN LOWER("Process Name") IMATCHES '.*(nmap|masscan|nbtscan|ipscan|angryip).*' THEN 'ExternalScanner'
    ELSE 'Other'
  END AS discovery_type,
  (
    CASE WHEN LOWER("CommandLine") IMATCHES '.*net[\s]+view.*|.*net1[\s]+view.*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*nltest.*(dclist|dsgetdc|domain_trusts).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*arp[\s]+(-a|/a).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*nbtstat[\s]+(-a|-A|-n|-S).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*ping.*-n[\s]+1.*|.*masscan.*|.*nbtscan.*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*(get-adcomputer|get-netcomputer|test-connection|invoke-portscan).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("Process Name") IMATCHES '.*(nmap|masscan|nbtscan|ipscan).*' THEN 1 ELSE 0 END
  ) AS suspicion_score
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 120, 143)
  AND QIDNAME(qid) IN ('Process Create', 'A new process has been created')
  AND (
    LOWER("Process Name") IMATCHES '.*(net\.exe|net1\.exe|ping\.exe|arp\.exe|nbtstat\.exe|nltest\.exe|nmap|masscan|nbtscan|ipscan)\..*'
    OR LOWER("CommandLine") IMATCHES '.*net[\s]+(view|group)|.*nltest.*(dclist|dsgetdc|domain_trusts)|.*arp[\s]+(-a|/a)|.*nbtstat[\s]+(-a|-A|-n|-S)|.*ping.*-n[\s]+1|.*masscan|.*nbtscan|.*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|invoke-portscan|networkInformation\.ping).*'
  )
  AND username NOT IN ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE')
HAVING suspicion_score > 0
ORDER BY starttime DESC
LAST 24 HOURS

Detects Remote System Discovery (T1018) in QRadar by querying Windows Security (EventID 4688) and Sysmon (EventID 1) process creation events for known network enumeration tool executions and suspicious command-line patterns. Assigns a suspicion score and classifies discovery type.

medium severity medium confidence

Data Sources

Windows Security Event Log (EventID 4688) Sysmon Event Log (EventID 1) IBM QRadar Windows log sources

Required Tables

events

False Positives

Network operations teams running authorized infrastructure audits using tools like Nmap or Angry IP Scanner
Monitoring agents (e.g., Zabbix, Nagios, PRTG) using ping sweeps or ARP queries to check host availability
Active Directory administrative scripts using Get-ADComputer or nltest for domain health verification and trust relationship management

Sumo Logic CSE

sql

_sourceCategory=windows* (sysmon OR wineventlog OR winlog)
| where EventID in ("1", "4688")
| parse field=CommandLine "*" as command_line nodrop
| parse field=NewProcessName "*" as process_path nodrop
| parse field=Image "*" as image_path nodrop
| eval process_path = if(isNull(process_path), image_path, process_path)
| eval command_lower = toLowerCase(command_line)
// Extract basename
| parse regex field=process_path "(?:[/\\\\])(?P<process_name>[^/\\\\]+)$" nodrop
// Score discovery indicators
| eval net_view = if(matches(command_lower, ".*net\s+view.*|.*net1\s+view.*"), 1, 0)
| eval nltest = if(matches(command_lower, ".*nltest.*(dclist|dsgetdc|domain_trusts|server).*"), 1, 0)
| eval arp_enum = if(matches(command_lower, ".*arp\s+(-a|/a).*"), 1, 0)
| eval nbtstat = if(matches(command_lower, ".*nbtstat\s+(-a|-A|-n|-S).*"), 1, 0)
| eval ping_sweep = if(matches(command_lower, ".*ping.*-n\s+1.*|.*for\s+/l.*ping.*|.*masscan.*|.*nbtscan.*"), 1, 0)
| eval ps_discovery = if(matches(command_lower, ".*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|invoke-portscan|networkInformation\.ping|\[net\.dns\]).*"), 1, 0)
| eval ext_scanner = if(matches(toLowerCase(process_name), ".*(nmap|masscan|nbtscan|ipscan|angryip).*"), 1, 0)
| eval suspicion_score = net_view + nltest + arp_enum + nbtstat + ping_sweep + ps_discovery + ext_scanner
| where suspicion_score > 0
| eval discovery_type = if(net_view=1, "NetView",
    if(nltest=1, "DomainDiscovery",
    if(arp_enum=1, "ARPCache",
    if(nbtstat=1, "NetBIOS",
    if(ping_sweep=1, "PingSweep",
    if(ps_discovery=1, "PSNetworkDiscovery",
    if(ext_scanner=1, "ExternalScanner", "Other")))))))
| where process_name != "svchost.exe" and process_name != "MsMpEng.exe"
| fields _messageTime, Computer, User, process_name, command_line, ParentImage, discovery_type, suspicion_score, net_view, nltest, arp_enum, nbtstat, ping_sweep, ps_discovery, ext_scanner
| sort by _messageTime desc

Detects Remote System Discovery (T1018) in Sumo Logic by parsing Windows Security and Sysmon process creation events. Applies indicator scoring across seven discovery categories including net view, nltest domain enumeration, ARP cache dump, NetBIOS scanning, ping sweeps, PowerShell-based discovery, and external scanners.

medium severity medium confidence

Data Sources

Windows Event Log (Security Channel, EventID 4688) Sysmon Operational Log (EventID 1) Sumo Logic Installed Collector with Windows Event Log source

Required Tables

windows* (Sumo Logic source categories for Windows event logs)

False Positives

Help desk staff using ARP or ping commands during network troubleshooting sessions on managed endpoints
Enterprise monitoring systems (Lansweeper, Spiceworks) that periodically run net view or ARP enumeration to maintain asset inventories
PowerShell-based automation scripts used by sysadmins to query Active Directory for computer objects during regular operations

Google Chronicle / SecOps

yaral

rule t1018_remote_system_discovery {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Remote System Discovery (T1018) via known enumeration tools, suspicious command patterns, PowerShell-based host discovery, and AD computer enumeration."
    severity = "MEDIUM"
    priority = "MEDIUM"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1018"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1018/"
    false_positives = "IT admin tools, monitoring agents, AD management scripts"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname != ""

    (
      // Known enumeration tool names
      re.regex($e.target.process.file.full_path, `(?i)(\\|/)(net\.exe|net1\.exe|ping\.exe|arp\.exe|nbtstat\.exe|nltest\.exe|nmap(\.exe)?|masscan(\.exe)?|nbtscan(\.exe)?|ipscan(\.exe)?)$`)

      or

      // Net view and domain enumeration patterns
      re.regex($e.target.process.command_line, `(?i)net[\s\t]+(view|group)|net1[\s\t]+view|nltest.*(dclist|dsgetdc|domain_trusts|server)`)

      or

      // ARP cache and NetBIOS enumeration
      re.regex($e.target.process.command_line, `(?i)arp[\s\t]+(-a|/a)|nbtstat[\s\t]+(-a|-A|-n|-S)`)

      or

      // Ping sweep indicators
      re.regex($e.target.process.command_line, `(?i)(ping.*-n[\s\t]+1|for[\s\t]+/l.*ping|masscan|nbtscan)`)

      or

      // PowerShell-based discovery
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)(powershell\.exe|pwsh\.exe)$`)
        and
        re.regex($e.target.process.command_line, `(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|Test-Connection|Test-NetConnection|NetworkInformation\.Ping|\[Net\.Dns\]|Resolve-DnsName|ping -n 1)`)
      )

      or

      // External scanner tool execution
      re.regex($e.target.process.file.full_path, `(?i)(nmap|masscan|nbtscan|ipscan|angryip)(\.exe)?$`)
    )

    // Exclude known-benign parents
    not re.regex($e.principal.process.file.full_path, `(?i)(\\|/)(services\.exe|msiexec\.exe|sccm\.exe|ccmexec\.exe)$`)

  match:
    $e.principal.hostname over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.target.process.command_line, `(?i)net[\s\t]+(view|group)|net1[\s\t]+view`), 20) +
      if(re.regex($e.target.process.command_line, `(?i)nltest.*(dclist|dsgetdc|domain_trusts)`), 30) +
      if(re.regex($e.target.process.command_line, `(?i)arp[\s\t]+(-a|/a)`), 15) +
      if(re.regex($e.target.process.command_line, `(?i)nbtstat[\s\t]+(-a|-A|-n|-S)`), 15) +
      if(re.regex($e.target.process.command_line, `(?i)ping.*-n[\s\t]+1|masscan|nbtscan`), 25) +
      if(re.regex($e.target.process.command_line, `(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|NetworkInformation\.Ping)`), 30) +
      if(re.regex($e.target.process.file.full_path, `(?i)(nmap|masscan|nbtscan|ipscan)(\.exe)?$`), 35)
    )
    $hostname = $e.principal.hostname
    $username = $e.principal.user.userid
    $process_name = $e.target.process.file.full_path
    $command_line = $e.target.process.command_line

  condition:
    $e
}

Detects Remote System Discovery (T1018) using Google Chronicle YARA-L 2.0. Monitors PROCESS_LAUNCH events for known network enumeration binaries, command-line patterns indicating net view, nltest, ARP/NetBIOS enumeration, ping sweeps, PowerShell-based host/AD discovery, and external scanner tools. Computes a risk score per host over a 5-minute window.

medium severity high confidence

Data Sources

Windows Endpoint telemetry via Chronicle UDM ingestion Sysmon logs parsed into UDM format Windows Security Event Log (4688) via Chronicle

Required Tables

UDM events (PROCESS_LAUNCH event type)

False Positives

Authorized network scanning during penetration testing engagements with written approval
Systems management software (SCCM, Intune) using nltest or net commands during client health evaluation
Security operations teams running scheduled vulnerability scans using Nmap or similar tools from designated scanner hosts

CrowdStrike LogScale (CQL)

cql

// T1018 - Remote System Discovery
// Branch 1: Known discovery tool execution and command patterns
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(\\|\/)(
nnet\.exe|
net1\.exe|
ping\.exe|
arp\.exe|
nbtstat\.exe|
nltest\.exe|
nmap(\.exe)?|
masscan(\.exe)?|
nbtscan(\.exe)?|
ipscan(\.exe)?
)$/
OR CommandLine = /(?i)(net[\s\t]+(view|group)|net1[\s\t]+view|nltest.*(dclist|dsgetdc|domain_trusts)|arp[\s\t]+(-a|\/a)|nbtstat[\s\t]+(-a|-A|-n|-S)|ping.*-n[\s\t]+1|masscan|nbtscan)/
OR (
  ImageFileName = /(?i)(\\|\/)(powershell\.exe|pwsh\.exe)$/
  AND CommandLine = /(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|Test-Connection|Test-NetConnection|NetworkInformation\.Ping|\[Net\.Dns\]|Resolve-DnsName)/
)

// Compute indicator flags
| NetView := if(CommandLine = /(?i)net[\s\t]+(view|group)|net1[\s\t]+view/, 1, 0)
| NLTest := if(CommandLine = /(?i)nltest.*(dclist|dsgetdc|domain_trusts)/, 1, 0)
| ARPEnum := if(CommandLine = /(?i)arp[\s\t]+(-a|\/a)/, 1, 0)
| NBTStat := if(CommandLine = /(?i)nbtstat[\s\t]+(-a|-A|-n|-S)/, 1, 0)
| PingSweep := if(CommandLine = /(?i)ping.*-n[\s\t]+1|masscan|nbtscan/, 1, 0)
| PSDiscovery := if(CommandLine = /(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|Test-Connection|NetworkInformation\.Ping)/, 1, 0)
| ExtScanner := if(ImageFileName = /(?i)(nmap|masscan|nbtscan|ipscan)(\.exe)?$/, 1, 0)

| SuspicionScore := NetView + NLTest + ARPEnum + NBTStat + PingSweep + PSDiscovery + ExtScanner
| where SuspicionScore > 0

| DiscoveryType := case(
    NetView = 1, "NetView",
    NLTest = 1, "DomainDiscovery",
    ARPEnum = 1, "ARPCache",
    NBTStat = 1, "NetBIOS",
    PingSweep = 1, "PingSweep",
    PSDiscovery = 1, "PSNetworkDiscovery",
    ExtScanner = 1, "ExternalScanner",
    "Other"
  )

// Exclude known-benign processes
| ParentBaseImage := replace(".*[\\\\/]", "", ParentBaseFileName)
| where ParentBaseImage != /(?i)(services\.exe|msiexec\.exe|sccm\.exe|ccmexec\.exe)/

| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, DiscoveryType, SuspicionScore, NetView, NLTest, ARPEnum, NBTStat, PingSweep, PSDiscovery, ExtScanner])
| sort(field=@timestamp, order=desc)

Detects Remote System Discovery (T1018) in CrowdStrike Falcon LogScale using ProcessRollup2 events. Evaluates process image name and command-line arguments against known enumeration tool names and suspicious patterns across seven discovery categories. Assigns a suspicion score and classifies by discovery type.

medium severity high confidence

Data Sources

CrowdStrike Falcon Endpoint Detection (ProcessRollup2 events) Falcon sensor telemetry from Windows endpoints

Required Tables

ProcessRollup2 (Falcon event stream)

False Positives

Red team or penetration testing operators executing authorized discovery commands on target systems within engagement scope
IT asset management tools (e.g., Spiceworks, Lansweeper, PDQ Inventory) that invoke net.exe, arp.exe, or ping.exe during scheduled scans
Windows Remote Management and RMM tools (ConnectWise, Kaseya) running network diagnostics that include ping sweeps or ARP enumeration

Sigma rule & cross-platform mapping

The detection logic for Remote System Discovery (T1018) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1018 Sigma rules on detection.fyi

Platform-specific guides for T1018

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-16 Research depth: deep

References (6)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Net View Domain Enumeration
Expected signal: Sysmon Event ID 1: Process Create for net.exe with CommandLine='net view /domain' and then 'net view'. Security Event ID 4688 (if command-line auditing enabled). Sysmon Event ID 3 may show NetBIOS/SMB connections to contacted hosts on port 137/445.
Test 2Ping Sweep of Local Subnet
Expected signal: Up to 254 Sysmon Event ID 1 events for ping.exe, each with a different target IP in CommandLine. Sysmon Event ID 11 for file creation of df00tech-sweep.txt. Network ICMP traffic visible in NetFlow/packet capture. File creation in TEMP directory.
Test 3PowerShell Get-ADComputer Enumeration
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ADComputer'. PowerShell ScriptBlock Log Event ID 4104 with full script. LDAP traffic from the host to domain controller on port 389/636. Sysmon Event ID 11 for CSV file creation in TEMP directory.
Test 4ARP Cache Enumeration
Expected signal: Sysmon Event ID 1: arp.exe with CommandLine='arp -a'. Security Event ID 4688 (if command-line auditing enabled). No network events generated — this is a purely local operation. Sysmon Event ID 11 for file creation of df00tech-arp.txt.
Test 5NLTest Domain Trust and DC Discovery
Expected signal: Sysmon Event ID 1: nltest.exe with CommandLine containing '/dclist:' and '/domain_trusts'. Security Event ID 4688 (if command-line auditing enabled). DNS queries for _ldap._tcp.dc._msdcs.<domain> visible in DNS logs.

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1018 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Remote System Discovery

What is T1018 Remote System Discovery?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1018

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Discovery

Popular Detections

What is T1018 Remote System Discovery?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1018

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hub

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox