Detect System Network Connections Discovery in Google Chronicle
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. Utilities and commands that acquire this information include netstat, 'net use', and 'net session'. In Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in. On cloud infrastructure, adversaries may enumerate Virtual Private Cloud or Virtual Network connectivity to map connected systems and services. This technique is commonly observed during post-compromise reconnaissance phases, often executed in rapid succession with other discovery techniques (T1033, T1016, T1057) as part of situational awareness gathering before lateral movement or data collection.
MITRE ATT&CK
- Tactic
- Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1049/
YARA-L Detection Query
rule T1049_SystemNetworkConnectionsDiscovery {
meta:
author = "Argus Detection Engineering"
description = "Detects T1049 network connection discovery via netstat, net use/session/view, and PowerShell network enumeration cmdlets. High-fidelity signal when combined with suspicious parent process."
severity = "MEDIUM"
priority = "MEDIUM"
mitre_attack_tactic = "Discovery"
mitre_attack_technique = "T1049"
reference = "https://attack.mitre.org/techniques/T1049/"
created = "2026-04-16"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.principal.hostname = $hostname
$e.principal.user.userid = $user
$e.target.process.command_line = $cmdline
$e.target.process.file.full_path = $image
(
// netstat with enumeration flags
(
re.regex($image, `(?i).*netstat\.exe$`) and
re.regex($cmdline, `(?i).*(\-ano|\-an |\-aon|\-naop|\-anp).*`)
) or
// net.exe / net1.exe discovery commands
(
re.regex($image, `(?i).*net1?\.exe$`) and
re.regex($cmdline, `(?i)\b(use|session|view)\b`)
) or
// PowerShell network enumeration
(
re.regex($image, `(?i).*(powershell|pwsh)\.exe$`) and
re.regex($cmdline, `(?i)(Get-NetTCPConnection|Get-NetUDPEndpoint|netstat)`)
) or
// Linux ss command
(
re.regex($image, `(?i).*/ss$`) and
re.regex($cmdline, `(?i)-(anp|tulnp|tunap)`)
) or
// Linux lsof for network
(
re.regex($image, `(?i).*/lsof$`) and
re.regex($cmdline, `(?i)-(i|nP)`)
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1049 System Network Connections Discovery. Matches process launch events where netstat, net.exe, net1.exe, PowerShell, ss, or lsof are executed with network enumeration arguments. Covers both Windows and Linux discovery patterns using UDM process event fields.
Data Sources
Required Tables
False Positives & Tuning
- System health check scripts deployed by operations teams that run netstat at regular intervals to monitor connection counts
- Security tools performing automated asset discovery that enumerate connections via PowerShell cmdlets across the fleet
- Developers on engineering workstations using lsof -i or ss -anp while debugging networked applications locally
Other platforms for T1049
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Active TCP/UDP Connections with netstat
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\netstat.exe, CommandLine='netstat -ano', ParentImage typically cmd.exe or the test runner. Security Event ID 4688 if command line auditing is enabled. Prefetch file update at C:\Windows\Prefetch\NETSTAT.EXE-*.pf.
- Test 2Enumerate Active Network Sessions with net session
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net session'. Security Event ID 4688 with command line. Prefetch update for NET.EXE-*.pf.
- Test 3Map Network Shares with net use
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net use'. Security Event ID 4688 if command line auditing is enabled. Prefetch file updated for NET.EXE-*.pf.
- Test 4PowerShell Network Connection Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-NetTCPConnection'. PowerShell ScriptBlock Logging Event ID 4104 capturing the full cmdlet invocation. No network connections generated by the discovery itself.
- Test 5Discovery Command Cluster Simulation
Expected signal: Multiple Sysmon Event ID 1 events within seconds: netstat.exe with '-ano', net.exe with 'session', net.exe with 'use', ipconfig.exe with '/all', arp.exe with '-a'. All sharing the same parent cmd.exe process. Security Event ID 4688 for each child process if command line auditing enabled.
References (11)
- https://attack.mitre.org/techniques/T1049/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/net-session
- https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/
- https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/rpt-apt38.pdf
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/
Unlock Pro Content
Get the full detection package for T1049 including response playbook, investigation guide, and atomic red team tests.