Remote System Discovery

let NetworkDiscoveryProcesses = dynamic(["net.exe", "net1.exe", "ping.exe", "arp.exe", "nbtstat.exe", "nltest.exe", "nmap", "masscan", "nbtscan", "ipscan"]);
let SuspiciousCommandPatterns = dynamic(["net view", "net1 view", "/domain", "net group", "nltest /dclist", "nltest /dsgetdc", "nltest /domain_trusts", "arp -a", "nbtstat -A", "nbtstat -a"]);
let PingSweepPattern = dynamic(["-n 1", "/c ping", "for /l", "1..254", "Test-Connection", "Test-NetConnection", "System.Net.NetworkInformation.Ping"]);
// Branch 1: Known network discovery tools and commands
let Branch1 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (NetworkDiscoveryProcesses)
    or ProcessCommandLine has_any (SuspiciousCommandPatterns)
| extend DiscoveryType = case(
    ProcessCommandLine has "net view" or ProcessCommandLine has "net1 view", "NetView",
    ProcessCommandLine has "nltest", "DomainDiscovery",
    ProcessCommandLine has "arp -a" or ProcessCommandLine has "arp /a", "ARPCache",
    ProcessCommandLine has "nbtstat", "NetBIOS",
    FileName =~ "ping.exe" and ProcessCommandLine has_any ("-n 1", "/c"), "PingSweep",
    FileName =~ "nmap" or FileName =~ "masscan" or FileName =~ "nbtscan", "ExternalScanner",
    "Other"
  );
// Branch 2: PowerShell-based ping sweeps and AD computer enumeration
let Branch2 = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PingSweepPattern)
    or ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer", "Invoke-Portscan", "netscan", "NetworkInformation.Ping", "Resolve-DnsName", "[Net.Dns]::GetHostEntry", "ping -n 1")
| extend DiscoveryType = case(
    ProcessCommandLine has_any ("Get-ADComputer", "Get-NetComputer"), "ADComputerEnum",
    ProcessCommandLine has_any ("NetworkInformation.Ping", "Test-Connection", "Test-NetConnection"), "PSPingSweep",
    ProcessCommandLine has_any ("Invoke-Portscan", "netscan"), "PSPortScan",
    "PSNetworkDiscovery"
  );
// Branch 3: hosts file access (passive discovery)
let Branch3 = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ @"C:\Windows\System32\drivers\etc"
| where FileName =~ "hosts"
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "csrss.exe")
| extend DiscoveryType = "HostsFileAccess";
union Branch1, Branch2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DiscoveryType
| sort by Timestamp desc

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval Image=coalesce(Image, NewProcessName)
| eval CommandLine=coalesce(CommandLine, ProcessCommandLine)
| eval ParentImage=coalesce(ParentImage, ParentProcessName)
| eval CommandLineLower=lower(CommandLine)
| eval ImageBasename=mvindex(split(Image, "\\"), -1)
// Score network discovery indicators
| eval NetView=if(match(CommandLineLower, "net\s+view|net1\s+view"), 1, 0)
| eval NLTest=if(match(CommandLineLower, "nltest.*(/dclist|/dsgetdc|/domain_trusts|/server)"), 1, 0)
| eval ARPEnum=if(match(CommandLineLower, "arp\s+(-a|/a)"), 1, 0)
| eval NBTStat=if(match(CommandLineLower, "nbtstat\s+(-a|-A|-n|-S)"), 1, 0)
| eval PingSweep=if(match(CommandLineLower, "ping.*-n\s+1|for\s+/l.*ping|ping.*255\.255|masscan|nbtscan"), 1, 0)
| eval PSDiscovery=if(match(CommandLineLower, "get-adcomputer|get-netcomputer|test-connection|test-netconnection|invoke-portscan|networkInformation\.ping|\[net\.dns\]"), 1, 0)
| eval ExternalScanner=if(match(ImageBasename, "nmap\.exe|masscan\.exe|nbtscan\.exe|ipscan\.exe|angryip"), 1, 0)
| eval SuspicionScore=NetView + NLTest + ARPEnum + NBTStat + PingSweep + PSDiscovery + ExternalScanner
| where SuspicionScore > 0
| eval DiscoveryType=case(
    NetView=1, "NetView",
    NLTest=1, "DomainDiscovery",
    ARPEnum=1, "ARPCache",
    NBTStat=1, "NetBIOS",
    PingSweep=1, "PingSweep",
    PSDiscovery=1, "PSNetworkDiscovery",
    ExternalScanner=1, "ExternalScanner",
    true(), "Other"
  )
| table _time, host, User, ImageBasename, CommandLine, ParentImage, DiscoveryType, SuspicionScore, NetView, NLTest, ARPEnum, NBTStat, PingSweep, PSDiscovery, ExternalScanner
| sort - _time

sequence by host.name with maxspan=5m
  [process where event.type == "start" and (
    process.name in~ ("net.exe", "net1.exe", "ping.exe", "arp.exe", "nbtstat.exe", "nltest.exe", "nmap", "masscan", "nbtscan", "ipscan") or
    (
      process.name in~ ("powershell.exe", "pwsh.exe") and (
        process.args : ("Get-ADComputer", "Get-NetComputer", "Invoke-Portscan", "Test-Connection", "Test-NetConnection", "NetworkInformation.Ping", "Resolve-DnsName", "[Net.Dns]::GetHostEntry") or
        process.command_line : ("*ping -n 1*", "*for /l*", "*1..254*")
      )
    ) or
    (
      process.command_line : ("*net view*", "*net1 view*", "*nltest*/dclist*", "*nltest*/dsgetdc*", "*nltest*/domain_trusts*", "*arp -a*", "*arp /a*", "*nbtstat -A*", "*nbtstat -a*", "*nbtstat -n*", "*nbtstat -S*")
    )
  )]
| where not process.parent.name in~ ("services.exe", "msiexec.exe", "sccm.exe", "ccmexec.exe")
| eval discovery_type = case(
    process.command_line : ("*net view*", "*net1 view*"), "NetView",
    process.command_line : ("*nltest*"), "DomainDiscovery",
    process.command_line : ("*arp -a*", "*arp /a*"), "ARPCache",
    process.command_line : ("*nbtstat*"), "NetBIOS",
    process.command_line : ("*ping*-n 1*", "*masscan*", "*nbtscan*"), "PingSweep",
    process.name in~ ("nmap", "masscan", "nbtscan", "ipscan"), "ExternalScanner",
    process.name in~ ("powershell.exe", "pwsh.exe") and process.command_line : ("*Get-ADComputer*", "*Get-NetComputer*"), "ADComputerEnum",
    process.name in~ ("powershell.exe", "pwsh.exe") and process.command_line : ("*Test-Connection*", "*NetworkInformation.Ping*"), "PSPingSweep",
    "Other"
  )
| keep @timestamp, host.name, user.name, process.name, process.command_line, process.parent.name, process.pid, discovery_type

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  "Process Name" AS process_name,
  "CommandLine" AS command_line,
  "ParentCommandLine" AS parent_command_line,
  CASE
    WHEN LOWER("CommandLine") IMATCHES '.*net[\s]+view.*|.*net1[\s]+view.*' THEN 'NetView'
    WHEN LOWER("CommandLine") IMATCHES '.*nltest.*(dclist|dsgetdc|domain_trusts).*' THEN 'DomainDiscovery'
    WHEN LOWER("CommandLine") IMATCHES '.*arp[\s]+(-a|/a).*' THEN 'ARPCache'
    WHEN LOWER("CommandLine") IMATCHES '.*nbtstat[\s]+(-a|-A|-n|-S).*' THEN 'NetBIOS'
    WHEN LOWER("CommandLine") IMATCHES '.*ping.*-n[\s]+1.*|.*masscan.*|.*nbtscan.*' THEN 'PingSweep'
    WHEN LOWER("CommandLine") IMATCHES '.*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|networkInformation\.ping).*' THEN 'PSNetworkDiscovery'
    WHEN LOWER("Process Name") IMATCHES '.*(nmap|masscan|nbtscan|ipscan|angryip).*' THEN 'ExternalScanner'
    ELSE 'Other'
  END AS discovery_type,
  (
    CASE WHEN LOWER("CommandLine") IMATCHES '.*net[\s]+view.*|.*net1[\s]+view.*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*nltest.*(dclist|dsgetdc|domain_trusts).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*arp[\s]+(-a|/a).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*nbtstat[\s]+(-a|-A|-n|-S).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*ping.*-n[\s]+1.*|.*masscan.*|.*nbtscan.*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*(get-adcomputer|get-netcomputer|test-connection|invoke-portscan).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("Process Name") IMATCHES '.*(nmap|masscan|nbtscan|ipscan).*' THEN 1 ELSE 0 END
  ) AS suspicion_score
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 120, 143)
  AND QIDNAME(qid) IN ('Process Create', 'A new process has been created')
  AND (
    LOWER("Process Name") IMATCHES '.*(net\.exe|net1\.exe|ping\.exe|arp\.exe|nbtstat\.exe|nltest\.exe|nmap|masscan|nbtscan|ipscan)\..*'
    OR LOWER("CommandLine") IMATCHES '.*net[\s]+(view|group)|.*nltest.*(dclist|dsgetdc|domain_trusts)|.*arp[\s]+(-a|/a)|.*nbtstat[\s]+(-a|-A|-n|-S)|.*ping.*-n[\s]+1|.*masscan|.*nbtscan|.*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|invoke-portscan|networkInformation\.ping).*'
  )
  AND username NOT IN ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE')
HAVING suspicion_score > 0
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=windows* (sysmon OR wineventlog OR winlog)
| where EventID in ("1", "4688")
| parse field=CommandLine "*" as command_line nodrop
| parse field=NewProcessName "*" as process_path nodrop
| parse field=Image "*" as image_path nodrop
| eval process_path = if(isNull(process_path), image_path, process_path)
| eval command_lower = toLowerCase(command_line)
// Extract basename
| parse regex field=process_path "(?:[/\\\\])(?P<process_name>[^/\\\\]+)$" nodrop
// Score discovery indicators
| eval net_view = if(matches(command_lower, ".*net\s+view.*|.*net1\s+view.*"), 1, 0)
| eval nltest = if(matches(command_lower, ".*nltest.*(dclist|dsgetdc|domain_trusts|server).*"), 1, 0)
| eval arp_enum = if(matches(command_lower, ".*arp\s+(-a|/a).*"), 1, 0)
| eval nbtstat = if(matches(command_lower, ".*nbtstat\s+(-a|-A|-n|-S).*"), 1, 0)
| eval ping_sweep = if(matches(command_lower, ".*ping.*-n\s+1.*|.*for\s+/l.*ping.*|.*masscan.*|.*nbtscan.*"), 1, 0)
| eval ps_discovery = if(matches(command_lower, ".*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|invoke-portscan|networkInformation\.ping|\[net\.dns\]).*"), 1, 0)
| eval ext_scanner = if(matches(toLowerCase(process_name), ".*(nmap|masscan|nbtscan|ipscan|angryip).*"), 1, 0)
| eval suspicion_score = net_view + nltest + arp_enum + nbtstat + ping_sweep + ps_discovery + ext_scanner
| where suspicion_score > 0
| eval discovery_type = if(net_view=1, "NetView",
    if(nltest=1, "DomainDiscovery",
    if(arp_enum=1, "ARPCache",
    if(nbtstat=1, "NetBIOS",
    if(ping_sweep=1, "PingSweep",
    if(ps_discovery=1, "PSNetworkDiscovery",
    if(ext_scanner=1, "ExternalScanner", "Other")))))))
| where process_name != "svchost.exe" and process_name != "MsMpEng.exe"
| fields _messageTime, Computer, User, process_name, command_line, ParentImage, discovery_type, suspicion_score, net_view, nltest, arp_enum, nbtstat, ping_sweep, ps_discovery, ext_scanner
| sort by _messageTime desc

rule t1018_remote_system_discovery {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects Remote System Discovery (T1018) via known enumeration tools, suspicious command patterns, PowerShell-based host discovery, and AD computer enumeration."
    severity = "MEDIUM"
    priority = "MEDIUM"
    mitre_attack_tactic = "Discovery"
    mitre_attack_technique = "T1018"
    mitre_attack_url = "https://attack.mitre.org/techniques/T1018/"
    false_positives = "IT admin tools, monitoring agents, AD management scripts"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname != ""

    (
      // Known enumeration tool names
      re.regex($e.target.process.file.full_path, `(?i)(\\|/)(net\.exe|net1\.exe|ping\.exe|arp\.exe|nbtstat\.exe|nltest\.exe|nmap(\.exe)?|masscan(\.exe)?|nbtscan(\.exe)?|ipscan(\.exe)?)$`)

      or

      // Net view and domain enumeration patterns
      re.regex($e.target.process.command_line, `(?i)net[\s\t]+(view|group)|net1[\s\t]+view|nltest.*(dclist|dsgetdc|domain_trusts|server)`)

      or

      // ARP cache and NetBIOS enumeration
      re.regex($e.target.process.command_line, `(?i)arp[\s\t]+(-a|/a)|nbtstat[\s\t]+(-a|-A|-n|-S)`)

      or

      // Ping sweep indicators
      re.regex($e.target.process.command_line, `(?i)(ping.*-n[\s\t]+1|for[\s\t]+/l.*ping|masscan|nbtscan)`)

      or

      // PowerShell-based discovery
      (
        re.regex($e.target.process.file.full_path, `(?i)(\\|/)(powershell\.exe|pwsh\.exe)$`)
        and
        re.regex($e.target.process.command_line, `(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|Test-Connection|Test-NetConnection|NetworkInformation\.Ping|\[Net\.Dns\]|Resolve-DnsName|ping -n 1)`)
      )

      or

      // External scanner tool execution
      re.regex($e.target.process.file.full_path, `(?i)(nmap|masscan|nbtscan|ipscan|angryip)(\.exe)?$`)
    )

    // Exclude known-benign parents
    not re.regex($e.principal.process.file.full_path, `(?i)(\\|/)(services\.exe|msiexec\.exe|sccm\.exe|ccmexec\.exe)$`)

  match:
    $e.principal.hostname over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.target.process.command_line, `(?i)net[\s\t]+(view|group)|net1[\s\t]+view`), 20) +
      if(re.regex($e.target.process.command_line, `(?i)nltest.*(dclist|dsgetdc|domain_trusts)`), 30) +
      if(re.regex($e.target.process.command_line, `(?i)arp[\s\t]+(-a|/a)`), 15) +
      if(re.regex($e.target.process.command_line, `(?i)nbtstat[\s\t]+(-a|-A|-n|-S)`), 15) +
      if(re.regex($e.target.process.command_line, `(?i)ping.*-n[\s\t]+1|masscan|nbtscan`), 25) +
      if(re.regex($e.target.process.command_line, `(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|NetworkInformation\.Ping)`), 30) +
      if(re.regex($e.target.process.file.full_path, `(?i)(nmap|masscan|nbtscan|ipscan)(\.exe)?$`), 35)
    )
    $hostname = $e.principal.hostname
    $username = $e.principal.user.userid
    $process_name = $e.target.process.file.full_path
    $command_line = $e.target.process.command_line

  condition:
    $e
}

// T1018 - Remote System Discovery
// Branch 1: Known discovery tool execution and command patterns
#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(\\|\/)(
nnet\.exe|
net1\.exe|
ping\.exe|
arp\.exe|
nbtstat\.exe|
nltest\.exe|
nmap(\.exe)?|
masscan(\.exe)?|
nbtscan(\.exe)?|
ipscan(\.exe)?
)$/
OR CommandLine = /(?i)(net[\s\t]+(view|group)|net1[\s\t]+view|nltest.*(dclist|dsgetdc|domain_trusts)|arp[\s\t]+(-a|\/a)|nbtstat[\s\t]+(-a|-A|-n|-S)|ping.*-n[\s\t]+1|masscan|nbtscan)/
OR (
  ImageFileName = /(?i)(\\|\/)(powershell\.exe|pwsh\.exe)$/
  AND CommandLine = /(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|Test-Connection|Test-NetConnection|NetworkInformation\.Ping|\[Net\.Dns\]|Resolve-DnsName)/
)

// Compute indicator flags
| NetView := if(CommandLine = /(?i)net[\s\t]+(view|group)|net1[\s\t]+view/, 1, 0)
| NLTest := if(CommandLine = /(?i)nltest.*(dclist|dsgetdc|domain_trusts)/, 1, 0)
| ARPEnum := if(CommandLine = /(?i)arp[\s\t]+(-a|\/a)/, 1, 0)
| NBTStat := if(CommandLine = /(?i)nbtstat[\s\t]+(-a|-A|-n|-S)/, 1, 0)
| PingSweep := if(CommandLine = /(?i)ping.*-n[\s\t]+1|masscan|nbtscan/, 1, 0)
| PSDiscovery := if(CommandLine = /(?i)(Get-ADComputer|Get-NetComputer|Invoke-Portscan|Test-Connection|NetworkInformation\.Ping)/, 1, 0)
| ExtScanner := if(ImageFileName = /(?i)(nmap|masscan|nbtscan|ipscan)(\.exe)?$/, 1, 0)

| SuspicionScore := NetView + NLTest + ARPEnum + NBTStat + PingSweep + PSDiscovery + ExtScanner
| where SuspicionScore > 0

| DiscoveryType := case(
    NetView = 1, "NetView",
    NLTest = 1, "DomainDiscovery",
    ARPEnum = 1, "ARPCache",
    NBTStat = 1, "NetBIOS",
    PingSweep = 1, "PingSweep",
    PSDiscovery = 1, "PSNetworkDiscovery",
    ExtScanner = 1, "ExternalScanner",
    "Other"
  )

// Exclude known-benign processes
| ParentBaseImage := replace(".*[\\\\/]", "", ParentBaseFileName)
| where ParentBaseImage != /(?i)(services\.exe|msiexec\.exe|sccm\.exe|ccmexec\.exe)/

| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, DiscoveryType, SuspicionScore, NetView, NLTest, ARPEnum, NBTStat, PingSweep, PSDiscovery, ExtScanner])
| sort(field=@timestamp, order=desc)