T1049 System Network Connections Discovery

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. MITRE ATT&CK

6 Sigma rules T1049 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first

highHackTool - SharpView Executionfrack113 · Windows

highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io) · Windows

lowNet.EXE ExecutionMichael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · Windows

lowSystem Network Connections Discovery - LinuxDaniil Yugoslavskiy, oscd.community · Linux

lowSystem Network Connections Discovery Via Net.EXEfrack113 · Windows

informationalSystem Network Connections Discovery - MacOsDaniil Yugoslavskiy, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Show all TCP/UDP/RAW/UNIX sockets on the page for ss

ss --all --tcpIdentify

Filter TCP sockets by states, only/exclude on the page for ss

ss state bucketIdentify

Show all TCP sockets connected to the local HTTPS port (443) on the page for ss

ss --tcp src :443Identify

Find the processes that have a given file open on the page for lsof

lsof path/to/fileIdentify

Find the process that opened a local internet port on the page for lsof

lsof -i :portIdentify

Only output the process ID (PID) on the page for lsof

lsof -t path/to/fileIdentify

List files opened by the given user on the page for lsof

lsof -u usernameIdentify

List files opened by the given command or process on the page for lsof

lsof -c process_or_command_nameIdentify

List files opened by a specific process, given its PID on the page for lsof

lsof -p process_idIdentify

List open files in a directory on the page for lsof

lsof +D path/to/directoryIdentify

Find the process that is listening on a local IPv6 TCP port and don't convert network or port numbers on the page for lsof

lsof -i6TCP:port -sTCP:LISTEN -n -PIdentify

Start or stop a Windows service synchronously on the page for net

net start serviceIdentify

And 35 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1049: a Sigma rule it trips is tagged with it, or its abuse is documented as it.