Suspicious Network Command

A Sigma rule for process creation on Windows, by frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'.

low 1 ATT&CK technique 5 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    CommandLine|re:
      - 'ipconfig\s+/all'
      - 'netsh\s+interface show interface'
      - 'arp\s+-a'
      - 'nbtstat\s+-n'
      - 'net\s+config'
      - 'route\s+print'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Show a detailed list of network adapters on the page for ipconfig

ipconfig /allIdentify

Display the IP configuration of the remote host on the page for psexec

psexec \\remote_host ipconfig /allIdentify

To display the entire contents of the IP routing table, type on the page for route_ws2008

route printIdentify

To display the routes in the IP routing table that begin with 10, type on the page for route_ws2008

route print 10.*Identify

Run an expression as a workflow on the page for Invoke-AsWorkflow

Invoke-AsWorkflow -Expression "ipconfig /all" -PSComputerName (Get-Content DomainControllers.txt) -AsJob -JobName IPConfig

Identify

ATT&CK

the techniques it is tagged with

T1016System Network Configuration Discovery

Suspicious Network Command

What it looks for

Command lines that trip it

ATT&CK

Other rules for T1016 System Network Configuration Discovery