T1049

System Network Connections Discovery

Discovery Last updated:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. Utilities and commands that acquire this information include netstat, 'net use', and 'net session'. In Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in. On cloud infrastructure, adversaries may enumerate Virtual Private Cloud or Virtual Network connectivity to map connected systems and services. This technique is commonly observed during post-compromise reconnaissance phases, often executed in rapid succession with other discovery techniques (T1033, T1016, T1057) as part of situational awareness gathering before lateral movement or data collection.

What is T1049 System Network Connections Discovery?

System Network Connections Discovery (T1049) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for System Network Connections Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated low severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1049 System Network Connections Discovery
Canonical reference
https://attack.mitre.org/techniques/T1049/
Microsoft Sentinel / Defender
kusto 
let NetworkDiscoveryCommands = dynamic([
  "netstat", "net use", "net session", "net view",
  "lsof", "who", "ss ", "nmap",
  "Get-NetTCPConnection", "Get-NetUDPEndpoint",
  "WNetOpenEnum", "WNetEnumResource",
  "show ip sockets", "show tcp brief"
]);
let SuspiciousParents = dynamic([
  "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe",
  "msbuild.exe", "InstallUtil.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    (FileName =~ "netstat.exe" and ProcessCommandLine has_any ("-ano", "-an", "-aon", "-naop", "-anp"))
    or (FileName =~ "net.exe" and ProcessCommandLine has_any ("use", "session", "view"))
    or (FileName =~ "net1.exe" and ProcessCommandLine has_any ("use", "session", "view"))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-NetTCPConnection", "Get-NetUDPEndpoint", "netstat"))
  )
| extend IsNetstat = FileName =~ "netstat.exe"
| extend IsNetUse = FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "use"
| extend IsNetSession = FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has "session"
| extend IsPSNetQuery = FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-NetTCPConnection", "Get-NetUDPEndpoint")
| extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend SuspicionScore = toint(SuspiciousParent) + toint(IsNetstat) + toint(IsNetSession)
| project Timestamp, DeviceName, AccountName, FileName,
         ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsNetstat, IsNetUse, IsNetSession, IsPSNetQuery, SuspiciousParent, SuspicionScore
| sort by Timestamp desc

Detects System Network Connections Discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Identifies execution of netstat with enumeration flags (-ano, -an, -aon), net use/session/view commands, and PowerShell cmdlets (Get-NetTCPConnection, Get-NetUDPEndpoint) commonly used by adversaries for situational awareness. Flags executions originating from suspicious parent processes (PowerShell, scripting engines, LOLBins) as higher-confidence indicators. Assigns a suspicion score to prioritize analyst review of multi-indicator events.

low severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • System administrators running netstat or net session to troubleshoot connectivity issues from their workstations or servers
  • Network monitoring agents (SolarWinds, Datadog, PRTG) that periodically poll active connections using netstat or PowerShell cmdlets
  • Software installers and update agents that enumerate network sessions before performing operations
  • Help desk and IT operations scripts that collect network state as part of diagnostic bundles or remote support sessions
  • Security tools (vulnerability scanners, EDR agents) enumerating active connections for endpoint telemetry

Sigma rule & cross-platform mapping

The detection logic for System Network Connections Discovery (T1049) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1049 Sigma rules on detection.fyi

Platform-specific guides for T1049

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-16 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Enumerate Active TCP/UDP Connections with netstat

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\netstat.exe, CommandLine='netstat -ano', ParentImage typically cmd.exe or the test runner. Security Event ID 4688 if command line auditing is enabled. Prefetch file update at C:\Windows\Prefetch\NETSTAT.EXE-*.pf.

  2. Test 2Enumerate Active Network Sessions with net session

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net session'. Security Event ID 4688 with command line. Prefetch update for NET.EXE-*.pf.

  3. Test 3Map Network Shares with net use

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net use'. Security Event ID 4688 if command line auditing is enabled. Prefetch file updated for NET.EXE-*.pf.

  4. Test 4PowerShell Network Connection Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-NetTCPConnection'. PowerShell ScriptBlock Logging Event ID 4104 capturing the full cmdlet invocation. No network connections generated by the discovery itself.

  5. Test 5Discovery Command Cluster Simulation

    Expected signal: Multiple Sysmon Event ID 1 events within seconds: netstat.exe with '-ano', net.exe with 'session', net.exe with 'use', ipconfig.exe with '/all', arp.exe with '-a'. All sharing the same parent cmd.exe process. Security Event ID 4688 for each child process if command line auditing enabled.

Response Playbook

Triage

  1. Identify the initiating user account — is this a service account, a privileged admin, or a standard end-user? Standard users running netstat with -ano flags on servers warrant closer examination than sysadmins on their own workstations.
  2. Examine the parent process chain — was netstat or net session spawned by a scripting engine (wscript.exe, cscript.exe, mshta.exe), an Office application, or a downloaded executable? A suspicious parent is a strong escalation indicator. Check InitiatingProcessFileName and InitiatingProcessCommandLine.
  3. Check temporal clustering — did this network discovery event occur within seconds or minutes of other discovery commands (whoami, ipconfig, systeminfo, net group, tasklist)? Rapid sequential discovery commands indicate automated post-compromise enumeration. Query DeviceProcessEvents for the same DeviceName in a ±5 minute window.
  4. Review the command flags — 'netstat -ano' enumerates all connections with process IDs, a favorite of attackers mapping active C2 connections or finding pivot points. 'net session' lists authenticated SMB sessions from remote hosts, relevant for lateral movement planning. 'net use' shows currently mapped drives that could expose file shares.
  5. Check for any outbound network connections made by the initiating process — if a PowerShell or cmd.exe process ran netstat and then made outbound connections to external IPs, the data may have been exfiltrated. Query DeviceNetworkEvents for the same ProcessId around the same Timestamp.
  6. Determine if the device is a server, domain controller, or workstation — network discovery on a domain controller or file server by a non-administrative account is significantly more suspicious than on a developer workstation.

Containment

  1. If discovery activity is confirmed as part of an active intrusion and lateral movement is suspected, isolate the endpoint immediately using EDR network isolation to prevent the attacker from acting on the connection information gathered.
  2. If net session output could have exposed authenticated SMB sessions from other hosts, notify owners of those source machines that their credentials may be visible to a compromised host and initiate credential rotation.
  3. If net use revealed mapped drives to file servers, assess whether the attacker had read access to those shares and initiate a data access review on those file servers for the compromised account.
  4. If the parent process is a malicious script or executable, quarantine the file and block its hash at the endpoint security layer and email gateway.
  5. Reset credentials for the account under which the discovery commands ran if lateral movement or credential theft is suspected.

Evidence Collection

  1. Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 with command line auditing enabled. Capture full command line, parent process, and user context for all discovery-related process executions on the host within the incident timeframe.
  2. Process tree — reconstruct the full parent-child process chain using DeviceProcessEvents (KQL) or Sysmon logs to understand what launched the discovery command (Office macro → cmd → netstat is a common malware pattern).
  3. Network connection events — Sysmon Event ID 3 for any outbound connections initiated by processes in the process tree around the same time as discovery commands.
  4. PowerShell ScriptBlock Logging (Event ID 4104) — if PowerShell was used to run Get-NetTCPConnection or equivalent, capture the full script content from the PowerShell Operational log.
  5. Security Event ID 4624/4625 — check authentication events on the compromised host and any hosts identified in net session output to detect subsequent lateral movement attempts.
  6. Prefetch files — C:\Windows\Prefetch\NETSTAT.EXE-*.pf and C:\Windows\Prefetch\NET.EXE-*.pf provide execution timestamps and run counts to establish how often these commands have been used.
  7. Scheduled Task and Service logs — if the discovery commands are executing on a schedule, check for newly registered scheduled tasks (Event ID 4698) or services (Event ID 7045/4697) that may indicate persistence.
  8. Memory forensics — if a live memory image is available, dump the process memory of any suspicious parent processes to recover in-memory payloads that spawned the discovery commands.

Escalation Criteria

  • ! Network discovery commands were spawned by an Office application, browser, or scripting engine (mshta, wscript, cscript) — indicates initial access followed by in-memory discovery execution.
  • ! Discovery occurred on a domain controller, file server, or other high-value server, especially from a non-privileged or service account that would not normally perform this activity.
  • ! Rapid sequential execution of multiple discovery techniques within a short window (netstat + ipconfig + whoami + tasklist within 2 minutes) — consistent with automated post-exploitation frameworks (Cobalt Strike, Metasploit, PoshC2).
  • ! Net session output on the compromised host reveals authenticated sessions from other high-value systems (domain controllers, file servers, backup servers), enabling targeted lateral movement.
  • ! Discovery activity preceded by or followed by network connections to external or unusual IPs — suggests C2 communication before or after situational awareness gathering.
  • ! Same discovery pattern observed on multiple endpoints within a short timeframe — indicates automated lateral movement or worm-like propagation after initial compromise.

Investigation Guide

Forensic Artifacts

  • > Prefetch: C:\Windows\Prefetch\NETSTAT.EXE-*.pf — execution timestamps and run count, confirming when and how often netstat was invoked
  • > Prefetch: C:\Windows\Prefetch\NET.EXE-*.pf — execution timestamps for net use/session/view commands
  • > Event Log: Security Event ID 4688 (Process Creation with command-line auditing) — full command line for netstat and net commands if Sysmon is not available
  • > Event Log: Sysmon Event ID 1 — process creation with hashes, command line, and parent process for the discovery commands
  • > Event Log: Sysmon Event ID 3 — network connections, cross-referencing PIDs revealed by netstat -ano with process creation events
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — commands typed in Run dialog, may include netstat invocations
  • > Shell history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — PowerShell command history showing Get-NetTCPConnection usage
  • > Memory: Volatility 'netscan' or 'connections' plugin output — compare live/historic connections against netstat output to identify hidden connections that tools may have concealed
  • > SMB logs: Windows Event ID 5140 (network share access) on target servers — cross-correlate with net session data collected by the attacker to track subsequent lateral movement

Tuning Guidance

T1049 detections suffer from high false positive rates because netstat and net commands are legitimate administrative tools used daily by IT staff and monitoring software. Start by building an allowlist of known-good parent process + user account combinations using 30 days of baseline data. Key tuning steps: (1) Exclude known monitoring agent service accounts (e.g., datadog-agent, solarwinds, zabbix) from alerting entirely but retain in logs. (2) Exclude developer workstations where regular netstat usage is expected, or apply a higher suspicion score threshold for those device groups. (3) Focus high-priority alerting on server-class machines (domain controllers, file servers, database servers) where discovery commands from interactive user accounts are anomalous. (4) Require SuspicionScore >= 2 for workstations (e.g., suspicious parent AND netstat with -ano flag) to reduce noise. (5) The highest-value detections come from parent process chain analysis — a netstat spawned from mshta or WINWORD is almost always malicious. Consider creating a separate, high-severity detection rule specifically for Office applications spawning discovery commands, distinct from the baseline frequency-based rule.

Hunting Queries

Hunt for hosts or accounts running network discovery commands at above-baseline frequency. More than 5 executions or more than 2 distinct command variants from the same account on the same host within 7 days suggests scripted or automated enumeration. Single legitimate admin sessions rarely require repeated netstat invocations.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("netstat.exe", "net.exe", "net1.exe")
| where ProcessCommandLine has_any ("netstat", "net use", "net session", "net view", "-ano", "-an", "-aon")
| summarize DiscoveryCount=count(), UniqueCommands=make_set(ProcessCommandLine), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName
| where DiscoveryCount > 5 or array_length(UniqueCommands) > 2
| sort by DiscoveryCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\netstat.exe" OR (Image="*\\net.exe" AND (CommandLine="*use*" OR CommandLine="*session*" OR CommandLine="*view*")))
| stats count as DiscoveryCount, values(CommandLine) as Commands, earliest(_time) as FirstSeen, latest(_time) as LastSeen
    by host, User, ParentImage
| where DiscoveryCount > 5 OR mvcount(Commands) > 2
| sort - DiscoveryCount

Hunt for discovery tool clustering — multiple distinct discovery binaries executing on the same host within a 2-minute window. Post-exploitation frameworks (Cobalt Strike, Metasploit Meterpreter, PoshC2) run enumeration modules in rapid succession. Three or more distinct discovery tools within 2 minutes is a strong indicator of automated post-compromise reconnaissance.

Hunting — KQL
kql 
let DiscoveryWindow = 2m;
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("netstat.exe", "net.exe", "net1.exe", "ipconfig.exe", "whoami.exe", "systeminfo.exe", "tasklist.exe", "arp.exe", "nltest.exe")
| summarize DiscoveryTools=make_set(FileName), CmdLines=make_set(ProcessCommandLine), Count=count() by DeviceName, AccountName, bin(Timestamp, DiscoveryWindow)
| where array_length(DiscoveryTools) >= 3
| project Timestamp, DeviceName, AccountName, DiscoveryTools, CmdLines, Count
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\netstat.exe" OR Image="*\\ipconfig.exe" OR Image="*\\whoami.exe" OR Image="*\\systeminfo.exe" OR Image="*\\tasklist.exe" OR Image="*\\arp.exe" OR Image="*\\nltest.exe" OR (Image="*\\net.exe" AND (CommandLine="*use*" OR CommandLine="*session*")))
| bin _time span=2m
| stats dc(Image) as UniqueTools, values(Image) as Tools, count as EventCount by _time, host, User
| where UniqueTools >= 3
| sort - _time

Hunt for network discovery commands spawned by high-risk parent processes — scripting engines, LOLBins, or Office applications. Legitimate netstat usage almost always originates from cmd.exe launched by a human or a known monitoring tool. Discovery commands spawned by PowerShell, wscript, mshta, or Office applications indicate malware or a post-exploitation framework executing discovery as part of an automated kill chain.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "netstat.exe" or (FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine has_any ("use", "session"))
| where InitiatingProcessFileName in~ (
    "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "rundll32.exe", "regsvr32.exe",
    "WINWORD.EXE", "EXCEL.EXE", "OUTLOOK.EXE", "POWERPNT.EXE"
  )
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\netstat.exe" OR (Image="*\\net.exe" AND (CommandLine="*use*" OR CommandLine="*session*")))
  (ParentImage="*\\powershell.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe"
   OR ParentImage="*\\mshta.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\WINWORD.EXE"
   OR ParentImage="*\\EXCEL.EXE" OR ParentImage="*\\OUTLOOK.EXE")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Enumerate Active TCP/UDP Connections with netstat
windows

Executes netstat with the -ano flag to list all active TCP and UDP connections with associated process IDs (PIDs). This is the most common adversary invocation of netstat, used to identify established C2 channels, listening services, and network segments visible from the compromised host. The -ano flags map connections to PIDs which can then be correlated with tasklist output. Used by threat actors including Zebrocy, Andariel, GravityRAT, and TeamTNT.

Command

powershell 
netstat -ano

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\netstat.exe, CommandLine='netstat -ano', ParentImage typically cmd.exe or the test runner. Security Event ID 4688 if command line auditing is enabled. Prefetch file update at C:\Windows\Prefetch\NETSTAT.EXE-*.pf.

Expected Detection

KQL: Matches on FileName=netstat.exe with ProcessCommandLine containing '-ano'. IsNetstat=true, SuspicionScore increments. SPL: IsNetstat=1, SuspicionScore >= 1. Alert fires at low severity; escalate if parent process is suspicious.

Test 2 Enumerate Active Network Sessions with net session
windows

Executes 'net session' to list all active SMB sessions established to the local machine from remote hosts. This reveals which remote computers have authenticated to shares on this system, including the username and connection duration. Threat actors use this output to identify lateral movement pivot candidates — any machines actively connected are already authenticated and may be accessible. Used by menuPass (APT10) and KONNI malware.

Command

powershell 
net session

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net session'. Security Event ID 4688 with command line. Prefetch update for NET.EXE-*.pf.

Expected Detection

KQL: Matches on FileName=net.exe with ProcessCommandLine containing 'session'. IsNetSession=true. SPL: IsNetSession=1, SuspicionScore >= 1. Combined with other discovery commands in the same session, escalates to medium confidence.

Test 3 Map Network Shares with net use
windows

Executes 'net use' without arguments to list all currently mapped network drives and their remote UNC paths. Adversaries use this output to identify accessible file servers, backup paths, and shared storage that can be targeted for data collection (T1039) or ransomware encryption (as used by Babuk). The output also reveals domain infrastructure through UNC paths.

Command

powershell 
net use

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net use'. Security Event ID 4688 if command line auditing is enabled. Prefetch file updated for NET.EXE-*.pf.

Expected Detection

KQL: Matches on FileName=net.exe with ProcessCommandLine containing 'use'. IsNetUse=true. SPL: IsNetUse=1, SuspicionScore >= 1.

Test 4 PowerShell Network Connection Enumeration
windows

Uses PowerShell's Get-NetTCPConnection cmdlet to enumerate all TCP connections with state, local address, remote address, and owning process ID. This is the PowerShell-native equivalent of 'netstat -ano' and is increasingly used by threat actors and red teams operating in PowerShell-heavy environments. Also demonstrates Get-NetUDPEndpoint for UDP endpoint enumeration. Output is piped to Select-Object to format the results as commonly done in post-exploitation scripts.

Command

powershell 
powershell.exe -NoProfile -Command "Get-NetTCPConnection | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess | Sort-Object State"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-NetTCPConnection'. PowerShell ScriptBlock Logging Event ID 4104 capturing the full cmdlet invocation. No network connections generated by the discovery itself.

Expected Detection

KQL: Matches on FileName=powershell.exe with ProcessCommandLine containing 'Get-NetTCPConnection'. IsPSNetQuery=true. SPL: IsPSNetQuery=1, SuspicionScore >= 1. If launched from a suspicious parent, SuspiciousParent also fires.

Test 5 Discovery Command Cluster Simulation
windows

Executes a rapid sequence of network discovery commands matching the pattern observed in post-exploitation frameworks and threat actor toolkits. This simulates the automated enumeration phase seen with groups like APT38, Andariel, and tools like PoshC2. The sequence mirrors real-world kill chains where network, user, and process discovery commands are run within seconds of each other. This is designed to trigger the clustering hunting query.

Command

powershell 
cmd.exe /c "netstat -ano & net session & net use & ipconfig /all & arp -a"

Expected Telemetry

Multiple Sysmon Event ID 1 events within seconds: netstat.exe with '-ano', net.exe with 'session', net.exe with 'use', ipconfig.exe with '/all', arp.exe with '-a'. All sharing the same parent cmd.exe process. Security Event ID 4688 for each child process if command line auditing enabled.

Expected Detection

KQL hunting query: Detects 3+ distinct discovery tools within 2-minute bin window on same DeviceName/AccountName. SPL hunting query: UniqueTools >= 3 within 2-minute span. Main detection: Multiple IsNet* fields set to true. High-confidence escalation trigger due to automated discovery cluster pattern.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1033System Owner/User DiscoveryT1016System Network Configuration DiscoveryT1016.001Internet Connection DiscoveryT1018Remote System DiscoveryT1069Permission Groups DiscoveryT1057Process DiscoveryT1021.002SMB/Windows Admin SharesT1560Archive Collected DataT1087Account Discovery

Same Tactic: Discovery

Popular Detections