Technique:  System Network Connections Discovery
It actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download
It has used the netstat -naop tcp command to display TCP connections on a victim's machine.
It used the net use command to get a listing on network connections.
It has a tool that can enumerate current network connections.
It used the netstat -anpo tcp command to display TCP connections on the victim's machine.
It installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.
It has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.
Aria-body has the ability to gather TCP and UDP table status listings.
Babuk can use "WNetOpenEnumW" and "WNetEnumResourceW" to enumerate files in network resources for encryption.
It has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.
BADHATCH can execute netstat.exe -f on a compromised machine.
BlackEnergy has gathered information about local network connections using netstat.
Carbon uses the netstat -r and netstat -an commands.
CharmPower can use netsh wlan show profiles to list specific Wi-Fi profile details.
It has used netstat -ano | findstr EST to discover network connections.
Cobalt Strike can produce a sessions report from compromised hosts.
Comnie executes the netstat -ano command.
Conti can enumerate routine network connections from a compromised host.
CrackMapExec can discover active sessions for a targeted system.
Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.
Dtrack can collect network and active connection information.
The discovery modules used with Duqu can collect information on network connections.
It employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log "Microsoft-Windows-TerminalServices-RDPClient/Operational"(Event ID 1024) to obtain network information from RDP connections. It has also used netstat from a compromised system to obtain network connection information.
Egregor can enumerate all connected drives.
Empire can enumerate the current network connections of a host.
Epic uses the net use, net session, and netstat commands to gather information on network connections.
It has used netstat and other net  commands for network reconnaissance efforts.
Flagpro has been used to execute netstat -ano on a compromised host.
During FunnyDream, the threat actors used netstat to discover network connections on remote systems.
It used netstat -oan to obtain information about the victim network connections.
GravityRAT uses the netstat command to find open ports on the victim’s machine.
It has used netstat to monitor connections to specific ports.
jRAT can list network connections.
It performs local network connection discovery using netstat.
KONNI has used net session on the victim's machine.
KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.
Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.
It has used net use to identify and establish a network connection with a remote host.
Lizar has a plugin to retrieve information about all active network sessions on the infected server.
Lucifer can identify the IP and port numbers for all remote connections from the compromised host.
It uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.
Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.
It has used quser.exe to identify existing RDP connections.
Maze has used the "WNetOpenEnumW", "WNetEnumResourceW", "WNetCloseEnum" and "WNetAddConnection2W" functions to enumerate the network resources on the infected machine.
It has used net use to conduct connectivity checks to machines.
After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server.
It has used a PowerShell backdoor to check for Skype connections on the target machine.
It has used netstat -ano to determine network connection information.
nbtstat can be used to discover current NetBIOS sessions.
Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.
netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.
NETWIRE can capture session logon details from a compromised host.
It has used netstat -an on a victim to get a listing of network connections.
Okrum was seen using NetSess to discover NetBIOS sessions.
During Operation CuckooBees, the threat actors used the net session, net use, and netstat commands as part of their advanced reconnaissance.
During Operation Wocao, threat actors collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.
OSInfo enumerates the current network connections similar to  net use .
Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.
PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.
It obtains and saves information about victim network interfaces and addresses.
PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.
POWRUNER may collect active network connections by running netstat -an on a victim.
Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.
PyDCrypt has used netsh to find RPC connections on remote machines.
QakBot can use netstat to enumerate current network connections.
Ramsay can use netstat to enumerate network connections.
RATANKBA uses netstat -ano to search for specific IP address ranges.
RedLeaves can enumerate drives and Remote Desktop sessions.
Remsec can obtain a list of active connections and open ports.
It had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.
Sardonic has the ability to execute the netstat command.
ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.
SHOTPUT uses netstat to list TCP connection status.
Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.
Sliver can collect network connection information.
SLOTHFULMEDIA can enumerate open ports on a victim machine.
SpeakUp uses the arp -a command.
Sykipot may use netstat -ano to display active network connections.
It has run netstat -anp to search for rival malware connections. It has also used libprocesshider to modify /etc/ld.so.preload.
It has used net use and netstat to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.
Torisma can use WTSEnumerateSessionsW to monitor remote desktop connections.
Trojan.Karagany can use netstat to collect a list of network connections.
It has tested if the localhost network is available and other connection capability on an infected system using command scripts.
It surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. It RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.
USBferry can use netstat and nbtstat to detect active network connections.
Volgmer can gather information about TCP connection state.
It has used netstat -ano on compromised hosts to enumerate network connections.
Waterbear can use API hooks on GetExtendedTcpTable to retrieve a table containing a list of TCP endpoints available to the application.
Zebrocy uses netstat -aon to gather network connection information.