Skip to content

Latest commit

 

History

History
43 lines (30 loc) · 1.44 KB

T1016.md

File metadata and controls

43 lines (30 loc) · 1.44 KB

T1016 - System Network Configuration Discovery

Adversaries will likely look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).

Atomic Tests


Atomic Test #1 - System Network Configuration Discovery

Identify network configuration information

Supported Platforms: Windows

Run it with command_prompt!

ipconfig /all
netsh interface show
arp -a
nbtstat -n
net config


Atomic Test #2 - System Network Configuration Discovery

Identify network configuration information

Supported Platforms: macOS, Linux

Run it with sh!

arp -a
netstat -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c
ifconfig