# T1016.001 - System Network Configuration Discovery: Internet Connection Discovery

## Description from ATT&CK

> Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth.
> 
> Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.

[Source](https://attack.mitre.org/techniques/T1016/001)

## Atomic Tests

- [Atomic Test #1: Check internet connection using ping Windows](#atomic-test-1-check-internet-connection-using-ping-windows)
- [Atomic Test #2: Check internet connection using ping freebsd, linux or macos](#atomic-test-2-check-internet-connection-using-ping-freebsd-linux-or-macos)
- [Atomic Test #3: Check internet connection using Test-NetConnection in PowerShell (ICMP-Ping)](#atomic-test-3-check-internet-connection-using-test-netconnection-in-powershell-icmp-ping)
- [Atomic Test #4: Check internet connection using Test-NetConnection in PowerShell (TCP-HTTP)](#atomic-test-4-check-internet-connection-using-test-netconnection-in-powershell-tcp-http)
- [Atomic Test #5: Check internet connection using Test-NetConnection in PowerShell (TCP-SMB)](#atomic-test-5-check-internet-connection-using-test-netconnection-in-powershell-tcp-smb)

### Atomic Test #1: Check internet connection using ping Windows

Check internet connection using ping on Windows. The default target of the ping is 8.8.8.8 (Google Public DNS).

**Supported Platforms:** Windows

**auto_generated_guid:** `e184b6bd-fb28-48aa-9a59-13012e33d7dc`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| ping_target | target of the ping | url | 8.8.8.8|

#### Attack Commands: Run with `command_prompt`!

```cmd
ping -n 4 #{ping_target}
```

### Atomic Test #2: Check internet connection using ping freebsd, linux or macos

Check internet connection using ping on Linux, MACOS. The default target of the ping is 8.8.8.8 (Google Public DNS).

**Supported Platforms:** macOS, Linux

**auto_generated_guid:** `be8f4019-d8b6-434c-a814-53123cdcc11e`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| ping_target | target of the ping | url | 8.8.8.8|

#### Attack Commands: Run with `bash`!

```bash
ping -c 4 #{ping_target}
```

### Atomic Test #3: Check internet connection using Test-NetConnection in PowerShell (ICMP-Ping)

Check internet connection using PowerShell's Test-NetConnection cmdlet and the ICMP/Ping protocol. The default target is 8.8.8.8 (Google Public DNS).

**Supported Platforms:** Windows

**auto_generated_guid:** `f8160cde-4e16-4c8b-8450-6042d5363eb0`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| target | target of the request | string | 8.8.8.8|

#### Attack Commands: Run with `powershell`!

```powershell
Test-NetConnection -ComputerName #{target}
```

### Atomic Test #4: Check internet connection using Test-NetConnection in PowerShell (TCP-HTTP)

Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound HTTP (Port 80) access. The default target is www.google.com.

**Supported Platforms:** Windows

**auto_generated_guid:** `7c35779d-42ec-42ab-a283-6255b28e9d68`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| target | target of the request | string | www.google.com|

#### Attack Commands: Run with `powershell`!

```powershell
Test-NetConnection -CommonTCPPort HTTP -ComputerName #{target}
```

### Atomic Test #5: Check internet connection using Test-NetConnection in PowerShell (TCP-SMB)

Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound SMB (Port 445) access. The default target is 8.8.8.8.

**Supported Platforms:** Windows

**auto_generated_guid:** `d9c32b3b-7916-45ad-aca5-6c902da80319`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| target | target of the request | string | 8.8.8.8|

#### Attack Commands: Run with `powershell`!

```powershell
Test-NetConnection -CommonTCPPort SMB -ComputerName #{target}
```