sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
S-Type has used `ipconfig /all` on a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SHARPSTATS has the ability to identify the domain of the compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
STARWHALE has the ability to collect the IP address of an infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Saint Bot can collect the IP address of a victim machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Sardonic has the ability to execute the `ipconfig` command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
ShadowPad has collected the domain name of the victim system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Shamoon obtains the target's IP address and local network segment.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Sibot checked if the compromised system is configured to use proxies.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SideTwist has the ability to collect the domain name on a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Sliver has the ability to gather network configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Small Sieve can obtain the IP address of a victim host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SocGholish has the ability to enumerate the domain name of a victim, as well as if the host is a member of an Active Directory domain.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via `ipconfig.exe /all`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SpeakUp uses the `ifconfig -a` command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SpicyOmelette can identify the IP of a compromised system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Squirrelwaffle has collected the victim’s external IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
StrongPity can identify the IP address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Stuxnet collects the IP address of a compromised system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Sykipot may use `ipconfig /all` to gather system network configuration details.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Sys10 collects the local IP address of the victim and sends it to the C2.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
SysUpdate can collected the IP address and domain name of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
T9000 gathers and beacons the MAC and IP addresses during installation.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
TSCookie has the ability to identify the IP of the infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Taidoor has collected the MAC address of a compromised host; it can also use `GetAdaptersInfo` to identify network adapters.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
TajMahal has the ability to identify the MAC address on an infected host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Trojan.Karagany can gather information on the network configuration of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Turian can retrieve the internal IP address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
UPPERCUT has the capability to gather the victim's proxy information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
USBferry can detect the infected machine's network topology using `ipconfig` and `arp`.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Unknown Logger can obtain information about the victim's IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
VERMIN gathers the local IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Volgmer can gather the IP address from the victim's machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
WannaCry will attempt to determine the local network segment it is a part of.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
WellMail can identify the IP address of the victim system.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
WellMess can identify the IP address and user domain on the target machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Woody RAT can retrieve network interface and proxy information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Xbash can collect IP addresses and local intranet information from a victim’s machine.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
Zebrocy runs the `ipconfig /all` command.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
down_new has the ability to identify the MAC address of a compromised host.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
iKitten will look for the current IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
jRAT can gather victim internal and external IPs.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
nbtstat can be used to discover local NetBIOS domain names.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
route can be used to discover routing configuration information.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
yty runs `ipconfig /all` and collects the domain name.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
zwShell can obtain the victim IP address.
Technique: T1016 System Network Configuration Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
FIN13 has used `Ping` and `tracert` for network reconnaissance efforts.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
Gamaredon Group has tested connectivity between a compromised machine and a C2 server using  Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
HAFNIUM has checked for network connectivity from a compromised host using `ping`, including attempts to contact `google[.]com`.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
TA2541 has run scripts to check internet connectivity from compromised hosts.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
Turla has used `tracert` to check internet connectivity.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
DarkTortilla can check for internet connectivity by issuing HTTP GET requests.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
More_eggs has used HTTP GET requests to check internet connectivity.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
NKAbuse utilizes external services such as `ifconfig.me` to identify the victim machine's IP address.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
QakBot can measure the download speed on a targeted host.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS).
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
Rising Sun can test a connection to a specified network IP address over a specified port number.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
Woody RAT can make `Ping` GET HTTP requests to its C2 server at regular intervals for network connectivity checks.
Technique: T1016.001 System Network Configuration Discovery: Internet Connection Discovery, Tactic: TA0007 Discovery
Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.
Technique: T1016.002 System Network Configuration Discovery: Wi-Fi Discovery, Tactic: TA0007 Discovery
Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.
Technique: T1016.002 System Network Configuration Discovery: Wi-Fi Discovery, Tactic: TA0007 Discovery
Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.
Technique: T1016.002 System Network Configuration Discovery: Wi-Fi Discovery, Tactic: TA0007 Discovery
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network   as well, giving adversaries the ability to discover operational assets.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
APT3 has a tool that can detect the existence of remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
APT32 has enumerated DC servers using the command `net group "Domain Controllers" /domain`. The group has also used the `ping` command.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
APT39 has used NBTscan and custom tools to discover remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
BRONZE BUTLER typically use `ping` and Net to enumerate systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Deep Panda has used ping to identify other machines of interest.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Dragonfly has likely obtained a list of hosts in the victim environment.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Earth Lusca used the command `powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -
property * | findstr “Address””` to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used `nltest.exe /dclist` to retrieve a list of domain controllers.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Fox Kitten has used Angry IP Scanner to detect remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as `ping` to identify remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
HAFNIUM has enumerated domain controllers using `net group "Domain computers"` and `nltest /dclist`.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
HEXANE has used `net view` to enumerate domain machines.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Ke3chang has used network scanning and enumeration tools, including Ping.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Magic Hound has used Ping for discovery on targeted networks.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Naikon has used a netbios scanner for remote machine identification.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Scattered Spider can enumerate remote systems, such as VMware vCenter infrastructure.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Threat Group-3390 has used the `net view` command.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
ToddyCat has used `ping %REMOTE_HOST%` for post exploit discovery.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover remote systems on a local network using the `net view` and `net view /DOMAIN` commands. Turla has also used `net group "Domain Computers" /domain`, `net group "Domain Controllers" /domain`, and `net group "Exchange Servers" /domain` to enumerate domain computers, including the organization's DC and Exchange Server.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, `nltest/dclist`, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command `net view /domain` to a PlugX implant to gather information about remote systems on the network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
AdFind has the ability to query Active Directory for computers.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Bazar can enumerate remote systems using ` Net View`.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
BitPaymer can use `net view` to discover remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
BloodHound can enumerate and collect the properties of domain computers, including domain controllers.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Carbon uses the `net view` command.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Comnie runs the `net view` command
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Conti has the ability to discover hosts on a target network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
DRATzarus can search for other machines connected to compromised host and attempt to map the network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Diavol can use the ARP table to find remote hosts to scan.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Epic uses the `net view` command on the victim’s machine.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Flagpro has been used to execute `net view` on a targeted system.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
FunnyDream can collect information about hosts on the victim network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Industroyer can enumerate remote computers in the compromised network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Kinsing has used a script to parse files like `/etc/hosts` and SSH `known_hosts` to discover remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Kwampirs collects a list of available servers with the command `net view`.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
MURKYTOP has the capability to identify remote hosts on connected networks.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
NBTscan can list NetBIOS computer names.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Commands such as `net view` can be used in Net to gather information about available remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Nltest may be used to enumerate remote domain controllers using options such as `/dclist` and `/dsgetdc`.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
OSInfo performs a connection test to discover remote systems in the network
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Ping can be used to identify remote systems within a network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
PoetRAT used Nmap for remote system discovery.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
QakBot can identify remote systems through the `net view` command.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
RATANKBA runs the `net view /domain` and `net view` commands.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
ROADTools can enumerate Azure AD systems and devices.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Remsec can ping or traceroute a remote host.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
SILENTTRINITY can enumerate and collect the properties of domain computers.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Shamoon scans the C-class subnet of the IPs on the victim's interfaces.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
Sykipot may use `net view /domain` to display hostnames of available systems on a network.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
The TAINTEDSCRIBE command and execution module can perform target system enumeration.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
TrickBot can enumerate computers and network devices.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
USBferry can use `net view` to gather information about remote systems.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
njRAT can identify remote hosts on connected networks.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
yty uses the `net view` command for discovery.
Technique: T1018 Remote System Discovery, Tactic: TA0007 Discovery
During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Ke3chang has performed  frequent and scheduled data exfiltration from compromised networks.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Sidewinder has configured tools to automatically send collected files to attacker controlled servers.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
CosmicDuke exfiltrates collected files automatically over FTP to remote servers.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Crutch has automatically exfiltrated stolen files to Dropbox.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Ebury can automatically exfiltrate gathered SSH credentials.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Empire has the ability to automatically send collected data back to the threat actors' C2.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
LightNeuron can be configured to automatically exfiltrate files under a specified directory.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Machete’s collected files are exfiltrated automatically to remote servers.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
OutSteel can automatically upload collected files to its C2 server.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Peppy has the ability to automatically exfiltrate files and keylogs.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
StrongPity can automatically exfiltrate collected documents to the C2 server.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.
Technique: T1020 Automated Exfiltration, Tactic: TA0010 Exfiltration
Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.
Technique: T1021 Remote Services, Tactic: TA0008 Lateral Movement
Brute Ratel C4 has the ability to use RPC for lateral movement.
Technique: T1021 Remote Services, Tactic: TA0008 Lateral Movement
Kivars has the ability to remotely trigger keyboard input and mouse clicks.
Technique: T1021 Remote Services, Tactic: TA0008 Lateral Movement
MacMa can manage remote screen sessions.
Technique: T1021 Remote Services, Tactic: TA0008 Lateral Movement
Stuxnet can propagate via peer-to-peer communication and updates using RPC.
Technique: T1021 Remote Services, Tactic: TA0008 Lateral Movement
During C0015, the threat actors used RDP to access specific network hosts of interest.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
During C0018, the threat actors opened a variety of ports to establish RDP connections, including ports 28035, 32467, 41578, and 46892.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
During the C0032 campaign, TEMP.Veles utilized RDP throughout an operation.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
During Cutting Edge, threat actors used RDP with compromised credentials for lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
The APT1 group is known to have used RDP during operations.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
APT41 used RDP for lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
APT5 has moved laterally throughout victim environments using RDP.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Axiom has used RDP during operations.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Chimera has used RDP to access targeted systems.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Dragonfly has moved laterally via RDP.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
FIN10 has used RDP to move laterally to systems in the victim environment.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
FIN13 has remotely accessed compromised environments via Remote Desktop Services (RDS) for lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
FIN6 used RDP to move laterally in victim networks.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
FIN7 has used RDP to move laterally in victim environments.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
FIN8 has used RDP for lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Fox Kitten has used RDP to log in and move laterally in the target environment.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
HEXANE has used remote desktop sessions for lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Kimsuky has used RDP for direct remote point-and-click access.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Lazarus Group malware SierraCharlie uses RDP for propagation.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Leviathan has targeted RDP credentials and used it to move through the victim environment.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Magic Hound has used Remote Desktop Services to copy tools on targeted systems.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Patchwork attempted to use RDP to move laterally.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Silence has used RDP for lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
menuPass has used RDP connections to move across the victim network.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Imminent Monitor has a module for performing remote desktop access.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Koadic can enable remote desktop on the victim's machine.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Pysa has laterally moved using RDP connections.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
QuasarRAT has a module for performing remote desktop access.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
Revenge RAT has a plugin to perform RDP access.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
SDBbot has the ability to use RDP to connect to victim's machines.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
WarzoneRAT has the ability to control an infected PC using RDP.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
ZxShell has remote desktop functionality.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
jRAT can support RDP control.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
njRAT has a module for performing remote desktop access.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
zwShell has used RDP for lateral movement.
Technique: T1021.001 Remote Services: Remote Desktop Protocol, Tactic: TA0008 Lateral Movement
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized `net use` to connect to network shares.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
APT28 has mapped network drives using Net and administrator credentials.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
APT39 has used SMB for lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
APT41 has transferred implant files using Windows Admin Shares.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Chimera has used Windows admin shares to move laterally.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Cinnamon Tempest has used SMBexec for lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Deep Panda uses net.exe to connect to network shares using `net use` commands with compromised credentials.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
FIN13 has leveraged SMB to move laterally within a compromised network via application servers and SQL servers.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Fox Kitten has used valid accounts to access SMB shares.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Lazarus Group malware SierraAlfa accesses the `ADMIN$` share via SMB to conduct lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Moses Staff has used batch scripts that can enable SMB on a compromised host.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Sandworm Team has copied payloads to the `ADMIN$` share of remote systems and run `net use` to connect to network shares.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Threat Group-1314 actors mapped network drives using `net use`.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
ToddyCat has used locally mounted network shares for lateral movement through targated environments.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Turla used `net use` commands to connect to lateral systems within a network.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Anchor can support windows execution via SMB shares.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Brute Ratel C4 has the ability to use SMB to pivot in compromised networks.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Conficker variants spread through NetBIOS share propagation.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Diavol can spread throughout a network via SMB prior to encryption.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Kwampirs copies itself over network shares to move laterally on a victim network.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Lucifer can infect victims by brute forcing SMB.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Lateral movement can be done with Net through `net use` commands to connect to the on remote systems.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement
NotPetya can use PsExec, which interacts with the `ADMIN$` network share to execute commands on remote systems.
Technique: T1021.002 Remote Services: SMB/Windows Admin Shares, Tactic: TA0008 Lateral Movement