T1018

Remote System Discovery

Discovery Last updated:

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Common methods include net view, ping sweeps, ARP cache enumeration, NBT/NetBIOS scanning, and third-party tools such as Nmap, MASSCAN, NBTscan, and Angry IP Scanner. Adversaries may also read local host files (C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or query Active Directory for computer objects. On ESXi hosts, esxcli commands may be used to enumerate network peers.

What is T1018 Remote System Discovery?

Remote System Discovery (T1018) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Remote System Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, File: File Access, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1018 Remote System Discovery
Canonical reference
https://attack.mitre.org/techniques/T1018/
Microsoft Sentinel / Defender
kusto 
let NetworkDiscoveryProcesses = dynamic(["net.exe", "net1.exe", "ping.exe", "arp.exe", "nbtstat.exe", "nltest.exe", "nmap", "masscan", "nbtscan", "ipscan"]);
let SuspiciousCommandPatterns = dynamic(["net view", "net1 view", "/domain", "net group", "nltest /dclist", "nltest /dsgetdc", "nltest /domain_trusts", "arp -a", "nbtstat -A", "nbtstat -a"]);
let PingSweepPattern = dynamic(["-n 1", "/c ping", "for /l", "1..254", "Test-Connection", "Test-NetConnection", "System.Net.NetworkInformation.Ping"]);
// Branch 1: Known network discovery tools and commands
let Branch1 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (NetworkDiscoveryProcesses)
    or ProcessCommandLine has_any (SuspiciousCommandPatterns)
| extend DiscoveryType = case(
    ProcessCommandLine has "net view" or ProcessCommandLine has "net1 view", "NetView",
    ProcessCommandLine has "nltest", "DomainDiscovery",
    ProcessCommandLine has "arp -a" or ProcessCommandLine has "arp /a", "ARPCache",
    ProcessCommandLine has "nbtstat", "NetBIOS",
    FileName =~ "ping.exe" and ProcessCommandLine has_any ("-n 1", "/c"), "PingSweep",
    FileName =~ "nmap" or FileName =~ "masscan" or FileName =~ "nbtscan", "ExternalScanner",
    "Other"
  );
// Branch 2: PowerShell-based ping sweeps and AD computer enumeration
let Branch2 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PingSweepPattern)
    or ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer", "Invoke-Portscan", "netscan", "NetworkInformation.Ping", "Resolve-DnsName", "[Net.Dns]::GetHostEntry", "ping -n 1")
| extend DiscoveryType = case(
    ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer"), "ADComputerEnum",
    ProcessCommandLine has_any ("NetworkInformation.Ping", "Test-Connection", "Test-NetConnection"), "PSPingSweep",
    ProcessCommandLine has_any ("Invoke-Portscan", "netscan"), "PSPortScan",
    "PSNetworkDiscovery"
  );
// Branch 3: hosts file access (passive discovery)
let Branch3 = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ @"C:\Windows\System32\drivers\etc"
| where FileName =~ "hosts"
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "csrss.exe")
| extend DiscoveryType = "HostsFileAccess";
union Branch1, Branch2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DiscoveryType
| sort by Timestamp desc

Detects remote system discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents and DeviceFileEvents tables. Covers three branches: (1) native Windows tools such as net view, nltest, arp, nbtstat, and third-party scanners; (2) PowerShell-based techniques including Get-ADComputer, System.Net.NetworkInformation.Ping ping sweeps, Test-Connection, and PowerView's Get-NetComputer; (3) hosts file reads by unexpected processes. DiscoveryType field categorises the method for analyst triage.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution File: File Access Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

  • IT helpdesk and system administrators running net view or ping sweeps for legitimate troubleshooting
  • Network monitoring tools (PRTG, SolarWinds, Nagios, Zabbix) that periodically ping or enumerate hosts
  • Software deployment systems (SCCM, Ansible, Puppet) that query AD for computer objects via Get-ADComputer
  • Vulnerability scanning tools (Tenable Nessus, Qualys, Rapid7) running credentialed scans from authorised scanner hosts
  • Domain controllers running nltest for replication health checks

Sigma rule & cross-platform mapping

The detection logic for Remote System Discovery (T1018) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1018 Sigma rules on detection.fyi

Platform-specific guides for T1018

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-16 Research depth: deep
References (6)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Net View Domain Enumeration

    Expected signal: Sysmon Event ID 1: Process Create for net.exe with CommandLine='net view /domain' and then 'net view'. Security Event ID 4688 (if command-line auditing enabled). Sysmon Event ID 3 may show NetBIOS/SMB connections to contacted hosts on port 137/445.

  2. Test 2Ping Sweep of Local Subnet

    Expected signal: Up to 254 Sysmon Event ID 1 events for ping.exe, each with a different target IP in CommandLine. Sysmon Event ID 11 for file creation of df00tech-sweep.txt. Network ICMP traffic visible in NetFlow/packet capture. File creation in TEMP directory.

  3. Test 3PowerShell Get-ADComputer Enumeration

    Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ADComputer'. PowerShell ScriptBlock Log Event ID 4104 with full script. LDAP traffic from the host to domain controller on port 389/636. Sysmon Event ID 11 for CSV file creation in TEMP directory.

  4. Test 4ARP Cache Enumeration

    Expected signal: Sysmon Event ID 1: arp.exe with CommandLine='arp -a'. Security Event ID 4688 (if command-line auditing enabled). No network events generated — this is a purely local operation. Sysmon Event ID 11 for file creation of df00tech-arp.txt.

  5. Test 5NLTest Domain Trust and DC Discovery

    Expected signal: Sysmon Event ID 1: nltest.exe with CommandLine containing '/dclist:' and '/domain_trusts'. Security Event ID 4688 (if command-line auditing enabled). DNS queries for _ldap._tcp.dc._msdcs.<domain> visible in DNS logs.

Response Playbook

Triage

  1. Identify the exact command line: which discovery method was used (net view, ping sweep, nmap, Get-ADComputer, ARP, nltest)? Note the scope — single host vs. subnet vs. entire domain.
  2. Check the initiating process and parent chain: was the discovery tool spawned by a legitimate admin shell (cmd.exe from RDP session), an unexpected parent (Office, browser, mshta.exe, wscript.exe), or a known attacker framework stub?
  3. Verify the user account context: is this a named admin account, service account, or regular user? Would this user normally perform network enumeration? Check against change management records.
  4. Assess timing: was this triggered during business hours or at an unusual time (late night, weekend)? Does it correlate with a known maintenance window?
  5. Pivot to endpoint history: did this device recently receive a phishing email, run a suspicious macro, or show any earlier execution events that could indicate initial compromise?
  6. Check for volume and velocity: how many discovery commands were executed in quick succession? A single `net view` is low risk; a loop pinging all 254 hosts in a /24 within seconds is high risk.
  7. Correlate with network telemetry: are there concurrent outbound connections (Sysmon Event ID 3) to multiple internal IPs from this host at the same time as the discovery commands?

Containment

  1. If executed from a standard user account or unexpected context, isolate the endpoint from the network immediately using EDR network isolation to prevent lateral movement using newly discovered targets.
  2. If a domain admin account was used, disable the account and invalidate all active Kerberos tickets (run klist purge on DCs, or use the Active Directory Users and Computers snap-in to reset the account password).
  3. Block the source host's outbound traffic to internal subnets at the switch/VLAN level if lateral movement is suspected, to prevent the adversary from leveraging discovered hosts.
  4. If an external scanner binary (nmap.exe, masscan.exe) was dropped and executed, preserve the binary for forensic analysis before quarantine, then remove it.
  5. Revoke any active sessions for the compromised user across all systems (remote sessions, VPN, cloud SSO) to limit the adversary's use of discovered network knowledge.

Evidence Collection

  1. Process Creation Logs: Sysmon Event ID 1 or Security Event ID 4688 (requires command-line auditing GPO) — capture full command lines including target IPs or hostnames passed to ping, net, or nmap.
  2. Network Connection Events: Sysmon Event ID 3 — enumerate all internal IP connections made by the suspicious process during the discovery window to understand which hosts were actually reached.
  3. DNS Query Events: Sysmon Event ID 22 — if the adversary used hostname-based discovery (net view by name, Resolve-DnsName), DNS queries reveal the full list of resolved targets.
  4. Windows Security Event ID 4648 (Explicit Credential Logon) — if net view was used with alternate credentials, this event will capture the target and credentials used.
  5. Prefetch: C:\Windows\Prefetch\NET.EXE-*.pf, PING.EXE-*.pf, NMAP.EXE-*.pf — confirm execution timestamps and loaded libraries even if logs were cleared.
  6. PowerShell ScriptBlock Logs (Event ID 4104) — if PowerShell was used, the full deobfuscated script including Get-ADComputer filters or ping loop targets will be captured here.
  7. Memory forensics: if the discovery was performed by an injected process or in-memory tool (e.g., PowerView loaded via IEX), capture a process memory dump to recover the full module.
  8. ARP table snapshot: run `arp -a` on the compromised host to see which hosts were recently contacted, as ARP cache entries persist for minutes to hours after communication.

Escalation Criteria

  • ! Discovery executed by a non-administrator or service account that has no business reason for network enumeration — strong indicator of a compromised account being used in an attack chain.
  • ! Discovery tool (nmap, masscan, nbtscan) was not pre-installed — it was dropped to disk immediately before execution, indicating staged tooling consistent with a post-exploitation framework.
  • ! Large-scale sweep: ping or ARP sweep covering more than one /24 subnet, or net view /domain returning results and immediately followed by lateral movement attempts (SMB, WMI, RDP connections).
  • ! Discovery activity preceded by T1059 (scripting execution), T1055 (process injection), or T1105 (tool transfer) events on the same host within the last 60 minutes — indicates progression along an attack chain.
  • ! The discovery host is a non-administrative workstation, especially one that does not normally initiate outbound connections to server VLANs.
  • ! Multiple hosts in the environment showing the same discovery pattern within a short window — indicates automated lateral spread or a worm-like propagation mechanism (as seen with QakBot, Bazar, BlackCat).

Investigation Guide

Forensic Artifacts

  • > ARP Cache: `arp -a` output on the suspicious host reveals recently contacted internal IPs — persists for minutes to hours after network activity
  • > DNS Cache: `ipconfig /displaydns` reveals hostnames recently resolved by the host — helpful when adversary used hostname-based discovery
  • > Prefetch files: C:\Windows\Prefetch\NET.EXE-*.pf, PING.EXE-*.pf, NMAP.EXE-*.pf — confirm execution times even if event logs were cleared
  • > Windows Event Log — Security: Event ID 4688 with full command line (requires Process Creation auditing + Command Line policy) for each discovery tool invocation
  • > Sysmon Event ID 1 (Process Create): full command lines including any target IP ranges or domain arguments
  • > Sysmon Event ID 3 (Network Connect): all outbound TCP/UDP connections made by the scanning process, revealing which hosts responded
  • > Sysmon Event ID 22 (DNS Query): hostname resolution events indicating which names were looked up during host enumeration
  • > PowerShell ConsoleHost_history.txt: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — contains Get-ADComputer and ping sweep commands if run interactively
  • > NTDS.dit or AD Replication: if Get-ADComputer or BloodHound LDAP queries were used, DC LDAP access logs (Event ID 2889 or ETW) may capture the querying client

Tuning Guidance

Start by building a whitelist of authorised scanner host IPs and service accounts (Nessus scanner, SCCM, Zabbix, PRTG). These will generate the bulk of false positives and should be excluded by DeviceName or AccountName rather than by command pattern. For net view alerts, exclude domain controllers and helpdesk jump hosts where administrative enumeration is expected. Tune the ping sweep threshold based on your environment — in large enterprises, monitoring tools may issue dozens of pings per minute from specific hosts; raise the threshold for those sources only. For nltest alerts, exclude DCs and any server running ADFS or Azure AD Connect. Consider adding a time-window correlation: flag discovery commands only when they occur within 30 minutes of an anomalous logon (Event ID 4624 type 3 from an unusual source) or a script execution event on the same host, which dramatically reduces false positive volume while improving signal fidelity. PowerShell-based discovery (Get-ADComputer, PowerView) is inherently higher fidelity than ping — tune those last or not at all, as legitimate use of PowerView in non-pentesting environments is rare.

Hunting Queries

Hunt for repeated or widespread net view enumeration across multiple hosts or by a single account. Legitimate admin activity typically involves one-off commands; adversaries or automated tools often issue the same discovery command repeatedly or execute it from multiple compromised endpoints.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "net.exe" or FileName =~ "net1.exe"
| where ProcessCommandLine has "view"
| summarize DiscoveryCount=count(), Devices=dcount(DeviceName), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by AccountName, ProcessCommandLine
| where DiscoveryCount > 3 or Devices > 1
| sort by DiscoveryCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\net.exe" OR Image="*\\net1.exe") CommandLine="*view*"
| stats count as DiscoveryCount, dc(host) as Devices, earliest(_time) as FirstSeen, latest(_time) as LastSeen by User, CommandLine
| where DiscoveryCount > 3 OR Devices > 1
| sort - DiscoveryCount

Hunt for high-volume ping activity in short time windows (5-minute buckets) that exceeds 10 executions, characteristic of automated ping sweeps. Normal users rarely ping more than a handful of targets in succession; a burst of 10+ pings within 5 minutes strongly suggests scripted subnet sweeping.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "ping.exe"
| summarize PingCount=count(), UniqueTargets=dcount(ProcessCommandLine), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, AccountName, bin(Timestamp, 5m)
| where PingCount > 10
| project DeviceName, AccountName, FirstSeen, LastSeen, PingCount, UniqueTargets
| sort by PingCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\ping.exe"
| bin _time span=5m
| stats count as PingCount, dc(CommandLine) as UniqueTargets, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, User, _time
| where PingCount > 10
| sort - PingCount

Hunt for PowerShell-based remote host discovery using AD queries and network probe cmdlets. Get-ADComputer and Get-NetComputer (PowerView) are particularly significant because they return the full list of domain-joined machines from Active Directory, giving adversaries a comprehensive target list without generating network traffic to each host.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer", "Test-Connection", "NetworkInformation.Ping", "Test-NetConnection", "Resolve-DnsName", "[Net.Dns]")
| where InitiatingProcessFileName !in~ ("svchost.exe", "services.exe", "SYSTEM")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (CommandLine="*Get-ADComputer*" OR CommandLine="*Get-NetComputer*" OR CommandLine="*Test-Connection*" OR CommandLine="*NetworkInformation.Ping*" OR CommandLine="*Test-NetConnection*" OR CommandLine="*Resolve-DnsName*")
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Net View Domain Enumeration
windows

Executes net view /domain to enumerate all domains visible on the network, then net view to list shares on accessible hosts. This is a classic technique used by QakBot, BitPaymer, Bazar, and menuPass to map the network before lateral movement. The commands generate Security Event ID 4688 and Sysmon Event ID 1 with the full command line.

Command

powershell 
net view /domain
net view

Expected Telemetry

Sysmon Event ID 1: Process Create for net.exe with CommandLine='net view /domain' and then 'net view'. Security Event ID 4688 (if command-line auditing enabled). Sysmon Event ID 3 may show NetBIOS/SMB connections to contacted hosts on port 137/445.

Expected Detection

Alert fires on 'net view' pattern match. KQL: DiscoveryType='NetView'. SPL: NetView=1, SuspicionScore >= 1.

Test 2 Ping Sweep of Local Subnet
windows

Executes a for-loop ping sweep across the local /24 subnet using a single-packet ping to each host, the classic pattern used by Deep Panda and BADHATCH to map live hosts. Uses -n 1 to minimise noise while still generating process creation events for every ping invocation.

Command

powershell 
for /l %i in (1,1,254) do @ping -n 1 -w 100 192.168.1.%i | find "Reply" >> %TEMP%\df00tech-sweep.txt

Cleanup

powershell 
del %TEMP%\df00tech-sweep.txt 2>nul

Expected Telemetry

Up to 254 Sysmon Event ID 1 events for ping.exe, each with a different target IP in CommandLine. Sysmon Event ID 11 for file creation of df00tech-sweep.txt. Network ICMP traffic visible in NetFlow/packet capture. File creation in TEMP directory.

Expected Detection

Alert fires on high-volume ping.exe execution. KQL: PingSweep='PingSweep', hunting query fires on PingCount > 10 in 5-minute window. SPL: PingSweep=1, SuspicionScore >= 1.

Test 3 PowerShell Get-ADComputer Enumeration
windows

Uses PowerShell's Get-ADComputer cmdlet (requires RSAT Active Directory module) to enumerate all computer objects in the domain and export them. This is the technique used by frameworks like BloodHound/SharpHound and PowerView to build a comprehensive map of all domain-joined systems without generating network traffic to each host, making it stealthier than ping sweeps.

Command

powershell 
powershell.exe -Command "Import-Module ActiveDirectory; Get-ADComputer -Filter * -Properties Name,OperatingSystem,LastLogonDate | Select-Object Name,OperatingSystem,LastLogonDate | Export-Csv $env:TEMP\df00tech-computers.csv -NoTypeInformation"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-computers.csv -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ADComputer'. PowerShell ScriptBlock Log Event ID 4104 with full script. LDAP traffic from the host to domain controller on port 389/636. Sysmon Event ID 11 for CSV file creation in TEMP directory.

Expected Detection

Alert fires on 'Get-ADComputer' pattern match. KQL: DiscoveryType='ADComputerEnum'. SPL: PSDiscovery=1, SuspicionScore >= 1. Hunting query for PowerShell AD discovery fires.

Test 4 ARP Cache Enumeration
windows

Uses arp -a to read the local ARP cache, revealing IP-to-MAC mappings for hosts that have recently communicated with the compromised system. This is a passive, stealthy discovery method that generates no network traffic and no noise — the adversary simply reads information already cached by the OS. Used by adversaries with limited network access to silently identify nearby hosts.

Command

powershell 
arp -a > %TEMP%\df00tech-arp.txt
type %TEMP%\df00tech-arp.txt

Cleanup

powershell 
del %TEMP%\df00tech-arp.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: arp.exe with CommandLine='arp -a'. Security Event ID 4688 (if command-line auditing enabled). No network events generated — this is a purely local operation. Sysmon Event ID 11 for file creation of df00tech-arp.txt.

Expected Detection

Alert fires on 'arp -a' pattern match. KQL: DiscoveryType='ARPCache'. SPL: ARPEnum=1, SuspicionScore >= 1.

Test 5 NLTest Domain Trust and DC Discovery
windows

Uses nltest.exe to enumerate domain controllers and domain trust relationships, a technique used by Ember Bear, HAFNIUM, and numerous ransomware operators to map the AD structure before credential theft and lateral movement. nltest /dclist returns all DCs for the domain; /domain_trusts reveals trusted domains that may be targeted for cross-forest attacks.

Command

powershell 
nltest /dclist:%USERDOMAIN%
nltest /domain_trusts

Expected Telemetry

Sysmon Event ID 1: nltest.exe with CommandLine containing '/dclist:' and '/domain_trusts'. Security Event ID 4688 (if command-line auditing enabled). DNS queries for _ldap._tcp.dc._msdcs.<domain> visible in DNS logs.

Expected Detection

Alert fires on 'nltest' with '/dclist' or '/domain_trusts' pattern match. KQL: DiscoveryType='DomainDiscovery'. SPL: NLTest=1, SuspicionScore >= 1.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1016System Network Configuration DiscoveryT1046Network Service DiscoveryT1021Remote ServicesT1078Valid AccountsT1069Permission Groups DiscoveryT1087.002Domain AccountT1135Network Share DiscoveryT1049System Network Connections DiscoveryT1033System Owner/User Discovery

Same Tactic: Discovery

Popular Detections