MITRE ATT&CK technique

System Network Connections Discovery detection rulesT1049

System Network Connections Discovery (T1049) is a MITRE ATT&CK technique in the Discovery tactic. This page lists the 9 community-maintained Sigma detection rules in the library mapped to T1049 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, cisco, linux.

T1049 on attack.mitre.org9 rules

Tactic

Discovery

HackTool - SharpView Execution
high
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
windows · process_creation
Potential Pikabot Discovery Activity
high
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
windows · process_creation
Cisco Discovery
low
Find information about network devices that is not stored in config files
cisco
Net.EXE Execution
low
Detects execution of "Net.EXE".
windows · process_creation
System Network Connections Discovery - Linux
low
Detects usage of system utilities to discover system network connections
linux · process_creation
System Network Connections Discovery Via Net.EXE
low
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
windows · process_creation
Use Get-NetTCPConnection
low
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
windows · ps_classic_start
Use Get-NetTCPConnection - PowerShell Module
low
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
windows · ps_module
System Network Connections Discovery - MacOs
informational
Detects usage of system utilities to discover system network connections
macos · process_creation

Top products

Tactic

HackTool - SharpView Execution

Potential Pikabot Discovery Activity

Cisco Discovery

Net.EXE Execution

System Network Connections Discovery - Linux

System Network Connections Discovery Via Net.EXE

Use Get-NetTCPConnection

Use Get-NetTCPConnection - PowerShell Module

System Network Connections Discovery - MacOs