Which SIEM platforms have a T1018 detection rule?

df00tech provides T1018 (Remote System Discovery) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Remote System Discovery (T1018)?

Detecting Remote System Discovery requires the following data sources: Process: Process Creation, Command: Command Execution, File: File Access, Microsoft Defender for Endpoint.

What severity and confidence is the T1018 detection?

The T1018 detection is rated medium severity with medium confidence.

What are common false positives for T1018?

Common false positives for T1018 include: IT helpdesk and system administrators running net view or ping sweeps for legitimate troubleshooting; Network monitoring tools (PRTG, SolarWinds, Nagios, Zabbix) that periodically ping or enumerate hosts; Software deployment systems (SCCM, Ansible, Puppet) that query AD for computer objects via Get-ADComputer.

T1018 IBM QRadar · QRadar

Detect Remote System Discovery in IBM QRadar

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Common methods include net view, ping sweeps, ARP cache enumeration, NBT/NetBIOS scanning, and third-party tools such as Nmap, MASSCAN, NBTscan, and Angry IP Scanner. Adversaries may also read local host files (C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or query Active Directory for computer objects. On ESXi hosts, esxcli commands may be used to enumerate network peers.

MITRE ATT&CK

Tactic: Discovery
Technique: T1018 Remote System Discovery
Canonical reference: https://attack.mitre.org/techniques/T1018/

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  logsourcename(logsourceid) AS log_source,
  username,
  sourceip,
  "Process Name" AS process_name,
  "CommandLine" AS command_line,
  "ParentCommandLine" AS parent_command_line,
  CASE
    WHEN LOWER("CommandLine") IMATCHES '.*net[\s]+view.*|.*net1[\s]+view.*' THEN 'NetView'
    WHEN LOWER("CommandLine") IMATCHES '.*nltest.*(dclist|dsgetdc|domain_trusts).*' THEN 'DomainDiscovery'
    WHEN LOWER("CommandLine") IMATCHES '.*arp[\s]+(-a|/a).*' THEN 'ARPCache'
    WHEN LOWER("CommandLine") IMATCHES '.*nbtstat[\s]+(-a|-A|-n|-S).*' THEN 'NetBIOS'
    WHEN LOWER("CommandLine") IMATCHES '.*ping.*-n[\s]+1.*|.*masscan.*|.*nbtscan.*' THEN 'PingSweep'
    WHEN LOWER("CommandLine") IMATCHES '.*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|networkInformation\.ping).*' THEN 'PSNetworkDiscovery'
    WHEN LOWER("Process Name") IMATCHES '.*(nmap|masscan|nbtscan|ipscan|angryip).*' THEN 'ExternalScanner'
    ELSE 'Other'
  END AS discovery_type,
  (
    CASE WHEN LOWER("CommandLine") IMATCHES '.*net[\s]+view.*|.*net1[\s]+view.*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*nltest.*(dclist|dsgetdc|domain_trusts).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*arp[\s]+(-a|/a).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*nbtstat[\s]+(-a|-A|-n|-S).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*ping.*-n[\s]+1.*|.*masscan.*|.*nbtscan.*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("CommandLine") IMATCHES '.*(get-adcomputer|get-netcomputer|test-connection|invoke-portscan).*' THEN 1 ELSE 0 END +
    CASE WHEN LOWER("Process Name") IMATCHES '.*(nmap|masscan|nbtscan|ipscan).*' THEN 1 ELSE 0 END
  ) AS suspicion_score
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 13, 120, 143)
  AND QIDNAME(qid) IN ('Process Create', 'A new process has been created')
  AND (
    LOWER("Process Name") IMATCHES '.*(net\.exe|net1\.exe|ping\.exe|arp\.exe|nbtstat\.exe|nltest\.exe|nmap|masscan|nbtscan|ipscan)\..*'
    OR LOWER("CommandLine") IMATCHES '.*net[\s]+(view|group)|.*nltest.*(dclist|dsgetdc|domain_trusts)|.*arp[\s]+(-a|/a)|.*nbtstat[\s]+(-a|-A|-n|-S)|.*ping.*-n[\s]+1|.*masscan|.*nbtscan|.*(get-adcomputer|get-netcomputer|test-connection|test-netconnection|invoke-portscan|networkInformation\.ping).*'
  )
  AND username NOT IN ('SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE')
HAVING suspicion_score > 0
ORDER BY starttime DESC
LAST 24 HOURS

medium severity medium confidence

Detects Remote System Discovery (T1018) in QRadar by querying Windows Security (EventID 4688) and Sysmon (EventID 1) process creation events for known network enumeration tool executions and suspicious command-line patterns. Assigns a suspicion score and classifies discovery type.

Data Sources

Windows Security Event Log (EventID 4688)Sysmon Event Log (EventID 1)IBM QRadar Windows log sources

Required Tables

events

False Positives & Tuning

Network operations teams running authorized infrastructure audits using tools like Nmap or Angry IP Scanner
Monitoring agents (e.g., Zabbix, Nagios, PRTG) using ping sweeps or ARP queries to check host availability
Active Directory administrative scripts using Get-ADComputer or nltest for domain health verification and trust relationship management

Download portable Sigma rule (.yml)

Other platforms for T1018

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Net View Domain Enumeration
Expected signal: Sysmon Event ID 1: Process Create for net.exe with CommandLine='net view /domain' and then 'net view'. Security Event ID 4688 (if command-line auditing enabled). Sysmon Event ID 3 may show NetBIOS/SMB connections to contacted hosts on port 137/445.
Test 2Ping Sweep of Local Subnet
Expected signal: Up to 254 Sysmon Event ID 1 events for ping.exe, each with a different target IP in CommandLine. Sysmon Event ID 11 for file creation of df00tech-sweep.txt. Network ICMP traffic visible in NetFlow/packet capture. File creation in TEMP directory.
Test 3PowerShell Get-ADComputer Enumeration
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ADComputer'. PowerShell ScriptBlock Log Event ID 4104 with full script. LDAP traffic from the host to domain controller on port 389/636. Sysmon Event ID 11 for CSV file creation in TEMP directory.
Test 4ARP Cache Enumeration
Expected signal: Sysmon Event ID 1: arp.exe with CommandLine='arp -a'. Security Event ID 4688 (if command-line auditing enabled). No network events generated — this is a purely local operation. Sysmon Event ID 11 for file creation of df00tech-arp.txt.
Test 5NLTest Domain Trust and DC Discovery
Expected signal: Sysmon Event ID 1: nltest.exe with CommandLine containing '/dclist:' and '/domain_trusts'. Security Event ID 4688 (if command-line auditing enabled). DNS queries for _ldap._tcp.dc._msdcs.<domain> visible in DNS logs.

Last updated: 2026-04-16 Research depth: deep

References (9)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1018 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Related Techniques

T1016System Network Configuration Discovery T1046Network Service Discovery T1021Remote Services T1078Valid Accounts T1069Permission Groups Discovery T1087.002Domain Account T1135Network Share Discovery T1049System Network Connections Discovery T1033System Owner/User Discovery

Detect Remote System Discovery in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1018

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Discovery

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1018

Testing Methodology

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Discovery

Popular Detections

Get new detections in your inbox