Detect System Network Connections Discovery in Splunk
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. Utilities and commands that acquire this information include netstat, 'net use', and 'net session'. In Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in. On cloud infrastructure, adversaries may enumerate Virtual Private Cloud or Virtual Network connectivity to map connected systems and services. This technique is commonly observed during post-compromise reconnaissance phases, often executed in rapid succession with other discovery techniques (T1033, T1016, T1057) as part of situational awareness gathering before lateral movement or data collection.
MITRE ATT&CK
- Tactic
- Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1049/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1) OR (sourcetype="WinEventLog:Security" EventCode=4688)
| eval Image=coalesce(Image, NewProcessName)
| eval CommandLine=coalesce(CommandLine, lower(ProcessCommandLine))
| eval CommandLine=lower(CommandLine)
| eval ParentImage=coalesce(ParentImage, ParentProcessName)
| eval IsNetstat=if(match(Image, "netstat\.exe") AND match(CommandLine, "(-ano|-an|-aon|-naop|-anp)"), 1, 0)
| eval IsNetUse=if(match(Image, "(net\.exe|net1\.exe)") AND match(CommandLine, "\buse\b"), 1, 0)
| eval IsNetSession=if(match(Image, "(net\.exe|net1\.exe)") AND match(CommandLine, "\bsession\b"), 1, 0)
| eval IsNetView=if(match(Image, "(net\.exe|net1\.exe)") AND match(CommandLine, "\bview\b"), 1, 0)
| eval IsPSNetQuery=if(match(Image, "(powershell\.exe|pwsh\.exe)") AND match(CommandLine, "(get-nettcpconnection|get-netudpendpoint|netstat)"), 1, 0)
| eval SuspiciousParent=if(match(ParentImage, "(powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|wmic\.exe|msbuild\.exe)"), 1, 0)
| eval SuspicionScore=IsNetstat + IsNetUse + IsNetSession + IsNetView + IsPSNetQuery + SuspiciousParent
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, IsNetstat, IsNetUse, IsNetSession, IsNetView, IsPSNetQuery, SuspiciousParent, SuspicionScore
| sort - _timeDetects System Network Connections Discovery using Sysmon Event ID 1 (Process Creation) and Security Event ID 4688. Evaluates process executions across multiple discovery command categories: netstat with enumeration flags, net use/session/view, and PowerShell network cmdlets. Assigns a cumulative suspicion score to surface high-confidence events involving multiple indicators or suspicious parent process chains. Covers both Sysmon and native Windows Security logging paths for broad deployment compatibility.
Data Sources
Required Sourcetypes
False Positives & Tuning
- System administrators running netstat or net session to troubleshoot connectivity issues from their workstations or servers
- Network monitoring agents (SolarWinds, Datadog, PRTG) that periodically poll active connections using netstat or PowerShell cmdlets
- Software installers and update agents that enumerate network sessions before performing operations
- Help desk and IT operations scripts that collect network state as part of diagnostic bundles or remote support sessions
- Security tools (vulnerability scanners, EDR agents) enumerating active connections for endpoint telemetry
Other platforms for T1049
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Active TCP/UDP Connections with netstat
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\netstat.exe, CommandLine='netstat -ano', ParentImage typically cmd.exe or the test runner. Security Event ID 4688 if command line auditing is enabled. Prefetch file update at C:\Windows\Prefetch\NETSTAT.EXE-*.pf.
- Test 2Enumerate Active Network Sessions with net session
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net session'. Security Event ID 4688 with command line. Prefetch update for NET.EXE-*.pf.
- Test 3Map Network Shares with net use
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe, CommandLine='net use'. Security Event ID 4688 if command line auditing is enabled. Prefetch file updated for NET.EXE-*.pf.
- Test 4PowerShell Network Connection Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-NetTCPConnection'. PowerShell ScriptBlock Logging Event ID 4104 capturing the full cmdlet invocation. No network connections generated by the discovery itself.
- Test 5Discovery Command Cluster Simulation
Expected signal: Multiple Sysmon Event ID 1 events within seconds: netstat.exe with '-ano', net.exe with 'session', net.exe with 'use', ipconfig.exe with '/all', arp.exe with '-a'. All sharing the same parent cmd.exe process. Security Event ID 4688 for each child process if command line auditing enabled.
References (11)
- https://attack.mitre.org/techniques/T1049/
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/net-session
- https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/
- https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector
- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/rpt-apt38.pdf
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1049/T1049.md
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/
Unlock Pro Content
Get the full detection package for T1049 including response playbook, investigation guide, and atomic red team tests.