System Network Connections Discovery

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.^[1]^[2]^[3]

Utilities and commands that acquire this information include netstat, "net use," and "net session" with Net. In Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to "net session".

ID: T1049

Sub-techniques: No sub-techniques

Tactic: Discovery

Platforms: AWS, Azure, GCP, Linux, Windows, macOS

Permissions Required: Administrator, User

Data Sources: Process command-line parameters, Process monitoring

Contributors: Praetorian

Version: 2.1

Created: 31 May 2017

Last Modified: 15 March 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
admin@338	admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: `netstat -ano >> %temp%\download`^[44]
APT1	APT1 used the `net use` command to get a listing on network connections.^[45]
APT3	APT3 has a tool that can enumerate current network connections.^[11]^[41]^[42]
APT32	APT32 used the `netstat -anpo tcp` command to display TCP connections on the victim's machine.^[43]
APT38	APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.^[51]
APT41	APT41 used the `netstat` command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.^[52]
Aria-body	Aria-body has the ability to gather TCP and UDP table status listings.^[36]
BlackEnergy	BlackEnergy has gathered information about local network connections using netstat.^[23]^[24]
Carbon	Carbon uses the `netstat -r` and `netstat -an` commands.^[20]
Comnie	Comnie executes the `netstat -ano` command.^[19]
Duqu	The discovery modules used with Duqu can collect information on network connections.^[15]
Empire	Empire can enumerate the current network connections of a host.^[7]
Epic	Epic uses the `net use`, `net session`, and `netstat` commands to gather information on network connections.^[12]^[13]
GravityRAT	GravityRAT uses the `netstat` command to find open ports on the victim’s machine.^[25]
jRAT	jRAT can list network connections.^[29]
Ke3chang	Ke3chang performs local network connection discovery using `netstat`.^[46]^[47]
Kwampirs	Kwampirs collects a list of active and listening connections by using the command `netstat -nao` as well as a list of available network mappings with `net use`.^[17]
Machete	Machete uses the `netsh wlan show networks mode=bssid` and `netsh wlan show interfaces` commands to list all nearby WiFi networks and connected interfaces.^[31]
MAZE	MAZE has used the "WNetOpenEnumW", "WNetEnumResourceW", "WNetCloseEnum" and "WNetAddConnection2W" functions to enumerate the network resources on the infected machine.^[34]
menuPass	menuPass has used `net use` to conduct connectivity checks to machines.^[38]
MESSAGETAP	After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server. ^[33]
nbtstat	nbtstat can be used to discover current NetBIOS sessions.
Net	Commands such as `net use` and `net session` can be used in Net to gather information about network connections from a particular host.^[6]
netstat	netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.^[5]
OilRig	OilRig has used `netstat -an` on a victim to get a listing of network connections.^[39]
Okrum	Okrum was seen using NetSess to discover NetBIOS sessions.^[32]
OSInfo	OSInfo enumerates the current network connections similar to `net use` .^[11]
PlugX	PlugX has a module for enumerating TCP and UDP network connections and associated processes using the `netstat` command.^[27]
Poseidon Group	Poseidon Group obtains and saves information about victim network interfaces and addresses.^[37]
PoshC2	PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.^[8]
POWRUNER	POWRUNER may collect active network connections by running `netstat -an` on a victim.^[14]
Pupy	Pupy has a built-in utility command for `netstat`, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.^[4]
RATANKBA	RATANKBA uses `netstat -ano` to search for specific IP address ranges.^[10]
RedLeaves	RedLeaves can enumerate drives and Remote Desktop sessions.^[26]
Remsec	Remsec can obtain a list of active connections and open ports.^[18]
ShimRatReporter	ShimRatReporter used the Windows function `GetExtendedUdpTable` to detect connected UDP endpoints.^[9]
SHOTPUT	SHOTPUT uses netstat to list TCP connection status.^[21]
Soft Cell	Soft Cell used `netstat -oan` to obtain information about the victim network connections.^[50]
SpeakUp	SpeakUp uses the `arp -a` command. ^[28]
Sykipot	Sykipot may use `netstat -ano` to display active network connections.^[16]
Threat Group-3390	Threat Group-3390 has used `net use` to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.^[40]
Tropic Trooper	Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.^[35]
Turla	Turla surveys a system upon check-in to discover active local network connections using the `netstat -an`, `net use`, `net file`, and `net session` commands.^[12]^[48] Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the `GetTcpTable2` API call.^[49]
USBferry	USBferry can use `netstat` and `nbtstat` to detect active network connections.^[35]
Volgmer	Volgmer can gather information about TCP connection state.^[22]
Zebrocy	Zebrocy uses `netstat -aon` to gather network connection information.^[30]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

System Network Connections Discovery

Procedure Examples

Mitigations

Detection

References