Technique:  Remote System Discovery
During the 2015 Ukraine Electric Power Attack, It remotely discovered systems over LAN connections. OT systems were visible from the IT network   as well, giving adversaries the ability to discover operational assets.
During the 2016 Ukraine Electric Power Attack, It checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.
AdFind has the ability to query Active Directory for computers.
It has a tool that can detect the existence of remote systems.
It has enumerated DC servers using the command net group "Domain Controllers" /domain. The group has also used the ping command.
It has used NBTscan and custom tools to discover remote systems.
Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.
Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.
BADHATCH can use a PowerShell object such as, System.Net.NetworkInformation.Ping to ping a computer.
Bazar can enumerate remote systems using  Net View.
BitPaymer can use net view to discover remote systems.
Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.
BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.
BloodHound can enumerate and collect the properties of domain computers, including domain controllers.
It typically use ping and Net to enumerate systems.
During C0015, the threat actors used the commands net view /all /domain and ping to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.
Carbon uses the net view command.
It has utilized various scans and queries to find domain controllers and remote services in the target environment.
Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.
Comnie runs the net view command
Conti has the ability to discover hosts on a target network.
CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.
It has used ping to identify other machines of interest.
Diavol can use the ARP table to find remote hosts to scan.
It has likely obtained a list of hosts in the victim environment.
DRATzarus can search for other machines connected to compromised host and attempt to map the network.
It used the command powershell "Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -property * | findstr "Address"" to find the network information of successfully logged-in accounts to discovery addresses of other machines. It has also used multiple scanning tools to discover other machines within the same compromised network.
Epic uses the net view command on the victim’s machine.
It has used the open source tool Essential NetTools to map the network and build a list of targets.
It used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.
It has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.
Flagpro has been used to execute net view on a targeted system.
It has used Angry IP Scanner to detect remote systems.
FunnyDream can collect information about hosts on the victim network.
During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.
It used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.
It has enumerated domain controllers using net group "Domain computers" and nltest /dclist.
HermeticWizard can find machines on the local network by gathering known local IP addresses through DNSGetCacheDataTable, GetIpNetTable,WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY),NetServerEnum,GetTcpTable, and GetAdaptersAddresses.
It has used net view to enumerate domain machines.
It has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.
Industroyer can enumerate remote computers in the compromised network.
It has used network scanning and enumeration tools, including Ping.
Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.
Kwampirs collects a list of available servers with the command net view.
It used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
It has used Ping for discovery on targeted networks.
It uses scripts to enumerate IP ranges on the victim network. It has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.
MURKYTOP has the capability to identify remote hosts on connected networks.
It has used a netbios scanner for remote machine identification.
NBTscan can list NetBIOS computer names.
Commands such as net view can be used in Net to gather information about available remote systems.
njRAT can identify remote hosts on connected networks.
Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc.
Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.
During Operation CuckooBees, the threat actors used the net view and ping commands as part of their advanced reconnaissance.
During Operation Wocao, threat actors used nbtscan and ping to discover remote systems, as well as dsquery subnet on a domain controller to retrieve all subnets in the Active Directory.
OSInfo performs a connection test to discover remote systems in the network
Ping can be used to identify remote systems within a network.
PoetRAT used Nmap for remote system discovery.
QakBot can identify remote systems through the net view command.
RATANKBA runs the net view /domain and net view commands.
Remsec can ping or traceroute a remote host.
ROADTools can enumerate Azure AD systems and devices.
It has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.
It has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.
Shamoon scans the C-class subnet of the IPs on the victim's interfaces.
SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.
It has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.
SILENTTRINITY can enumerate and collect the properties of domain computers.
During the SolarWinds Compromise, It used AdFind to enumerate remote systems.
SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.
Sykipot may use net view /domain to display hostnames of available systems on a network.
The TAINTEDSCRIBE command and execution module can perform target system enumeration.
It has used the net view command.
TrickBot can enumerate computers and network devices.
It surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. It has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.
USBferry can use net view to gather information about remote systems.
It has used multiple methods, including Ping, to enumerate systems on compromised networks.
WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.
It has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. It has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.
yty uses the net view command for discovery.