Description
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command esxcli network nic list will retrieve the MAC address, while esxcli network ip interface ipv4 get will retrieve the local IPv4 address.(Citation: Trellix Rnasomhouse 2024)
Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Platforms
Sub-Techniques (2)
Threat Groups (44)
| ID | Group | Context |
|---|---|---|
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to pull system network informatio... |
| G1008 | SideCopy | [SideCopy](https://attack.mitre.org/groups/G1008) has identified the IP address of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021) |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used <code>ipconfig /all</code> to obtain information about the victim network configuration. The gro... |
| G0022 | APT3 | A keylogging tool used by [APT3](https://attack.mitre.org/groups/G0022) gathers network information from the victim, including the MAC address, IP add... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used `ipconfig/all` and web beacons sent via email to gather network configuration information.(C... |
| G0018 | admin@338 | [admin@338](https://attack.mitre.org/groups/G0018) actors used the following command after exploiting a machine with [LOWBALL](https://attack.mitre.or... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has executed multiple commands to enumerate network topology and settings including `ipconfig`,... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) collected MAC addresses from victim machines.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT ... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has used batch scripts to enumerate network information, including information about trusts, zones,... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.(Citation... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) used the <code>ipconfig /all</code> command to gather the IP address from the system.(Citation: Cyberea... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has collected IP information via IPInfo.(Citation: Rapid7 HAFNIUM Mar 2021) |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware to collect the victim’s IP address and domain name.(Citation: Securelist MuddyWat... |
| G0019 | Naikon | [Naikon](https://attack.mitre.org/groups/G0019) uses commands such as <code>netsh interface show</code> to discover network interface settings.(Citati... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has enumerated the host machine’s IP address.(Citation: Trend Micro TeamTNT) |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used malware to collect information on network interfaces, including the MAC address.(Citation... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has used <code>ipconfig</code> and <code>arp</code> to determine network configuration informat... |
| G0128 | ZIRCONIUM | [ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to enumerate proxy settings in the target environment.(Citation: Zscaler APT31 Covi... |
| G1015 | Scattered Spider | [Scattered Spider](https://attack.mitre.org/groups/G1015) has used network reconnaissance commands for discovery including `ping` and `nltest`.(Citati... |
| G1009 | Moses Staff | [Moses Staff](https://attack.mitre.org/groups/G1009) has collected the domain name of a compromised network.(Citation: Checkpoint MosesStaff Nov 2021) |
Associated Software (232)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) obtains the IP address, location, and other relevant network information from the victim’s machine... |
| S1204 | cd00r | Malware | [cd00r](https://attack.mitre.org/software/S1204) can discover the IP for the network interface on the compromised device.(Citation: Hartrell cd00r 200... |
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has a command to get the victim's domain and NetBIOS name.(Citation: Volexity PowerDuke November ... |
| S0605 | EKANS | Malware | [EKANS](https://attack.mitre.org/software/S0605) can determine the domain of a compromised host.(Citation: IBM Ransomware Trends September 2020) |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has collected the victim machine's local IP address information and MAC address.(Citation: US-C... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can enumerate the IP address on compromised systems.(Citation: Kaspersky ToddyCat June 2022) |
| S1145 | Pikabot | Malware | [Pikabot](https://attack.mitre.org/software/S1145) gathers victim network information through commands such as <code>ipconfig</code> and <code>ipconfi... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) can identify the IP address of a victim machine.(Citation: BlackBerry Amadey 2020) |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) collects the network adapter information and domain/username information based on current remote s... |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) can gather victim proxy information.(Citation: Proofpoint Leviathan Oct 2017) |
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.(Citat... |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) can gather information on the victim IP address.(Citation: Unit 42 NOKKI Sept 2018) |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) runs <code>ipconfig /all</code> and collects the domain name.(Citation: ASERT Donot March 2018) |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects information about the Internet adapter configuration.(Citation: Symantec Dragonfly... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) collects the IP address of a compromised system.(Citation: Nicolas Falliere, Liam O Murchu, Eric Ch... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may collect network configuration data by running <code>ipconfig /all</code> on a victim.(Citation... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) can use [Arp](https://attack.mitre.org/software/S0099) to discover a target's network configurati... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `ipconfig` command.(Citation: Bitdefender Sardonic Aug 2021) |
| S0082 | Emissary | Malware | [Emissary](https://attack.mitre.org/software/S0082) has the capability to execute the command <code>ipconfig /all</code>.(Citation: Emissary Trojan Fe... |
| S0271 | KEYMARBLE | Malware | [KEYMARBLE](https://attack.mitre.org/software/S0271) gathers the MAC address of the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018) |
References
- Gyler, C.,Perez D.,Jones, S.,Miller, S.. (2021, February 25). This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved February 17, 2022.
- Pham Duy Phuc, Max Kersten, Noël Keijzer, and Michaël Schrijver. (2024, February 14). RansomHouse am See. Retrieved March 26, 2025.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Frequently Asked Questions
What is T1016 (System Network Configuration Discovery)?
T1016 is a MITRE ATT&CK technique named 'System Network Configuration Discovery'. It belongs to the Discovery tactic(s). Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several opera...
How can T1016 be detected?
Detection of T1016 (System Network Configuration Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1016?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1016?
Known threat groups using T1016 include: BlackByte, SideCopy, GALLIUM, APT3, Kimsuky, admin@338, Volt Typhoon, APT41.