T1018 Remote System Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. MITRE ATT&CK
13 Sigma rules T1018 on attack.mitre.org
Sigma rules tagged with it
Command lines CmdID reads as it
To display a list of all user accounts for the local computer, run the following command on the page for net user
net userIdentifyTo display information about the user account TommyH, run the following command on the page for net user
net user tommyhIdentifyTo set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user
net user miked /time:M-F,08:00-17:00IdentifyTo set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user
net user miked /time:M-F,8AM-5PMIdentifyTo specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user
net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentifyPing a host with IP 10.0.0.1 (Note: 10.0.0.1 can be shortened to 10.1) on the page for ping
ping 10.0.0.1IdentifyAn example is here when CmdID’s reading of it names T1018: a Sigma rule it trips is tagged with it, or its abuse is documented as it.