T1016 System Network Configuration Discovery

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. MITRE ATT&CK

1 program on CmdID 7 Sigma rules T1016 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

netsh.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io) · Windows

mediumPotential Recon Activity Via Nltest.EXECraig Young, oscd.community, Georg Lauenstein · Windows

lowFirewall Configuration Discovery Via Netsh.EXEfrack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' · Windows

lowNltest.EXE ExecutionArun Chauhan · Windows

lowSuspicious Network Commandfrack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' · Windows

informationalSystem Network Discovery - LinuxÖmer Günal and remotephone, oscd.community · Linux

informationalSystem Network Discovery - macOSremotephone, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

List interfaces with detailed info on the page for ip

ip [aIdentify

List interfaces with brief network layer info on the page for ip

ip -brief [aIdentify

List interfaces with brief link layer info on the page for ip

ip -brief [lIdentify

View all available firewall zones and rules in their runtime configuration state on the page for firewall-cmd

firewall-cmd --list-all-zonesIdentify

Permanently move the interface into the block zone, effectively blocking all communication on the page for firewall-cmd

firewall-cmd --permanent --zone block --change-interface enp1s0Identify

Permanently open the port for a service in the specified zone (like port 443 when in the public zone) on the page for firewall-cmd

firewall-cmd --permanent --zone public --add-service httpsIdentify

Permanently close the port for a service in the specified zone (like port 80 when in the public zone) on the page for firewall-cmd

firewall-cmd --permanent --zone public --remove-service httpIdentify

Permanently forward a port for incoming packets in the specified zone (like port 443 to 8443 when entering the public zone) on the page for firewall-cmd

firewall-cmd --permanent --zone public --add-rich-rule 'rule family "ipv4" forward-port port "443" protocol "udp" to-port "8443"'

Identify

Reload firewalld to lose any runtime changes and force the permanent configuration to take effect immediately on the page for firewall-cmd

firewall-cmd --reloadIdentify

Save the runtime configuration state to the permanent configuration on the page for firewall-cmd

firewall-cmd --runtime-to-permanentIdentify

Enable panic mode in case of Emergency. All traffic is dropped, any active connection will be terminated on the page for firewall-cmd

firewall-cmd --panic-onIdentify

View network settings of an interface on the page for ifconfig

ifconfig interface_nameIdentify

And 147 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1016: a Sigma rule it trips is tagged with it, or its abuse is documented as it.