Description
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, esxcli network diag ping.
Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment.
Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Platforms
Threat Groups (41)
| ID | Group | Context |
|---|---|---|
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instance... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) used tools such as [Arp](https://attack.mitre.org/software/S0099) to identify remotely-connected de... |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used a modified version of [NBTscan](https://attack.mitre.org/software/S0590) to identify available N... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that can detect the existence of remote systems.(Citation: Symantec Buckeye)(Citation: FireEy... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used multiple methods, including [Ping](https://attack.mitre.org/software/S0097), to enumera... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) has used MiPing to discover active systems in the victim network.(Citation: apt41_dcsocytec_dec2022) |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has likely obtained a list of hosts in the victim environment.(Citation: US-CERT TA18-074A) |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) uses scripts to enumerate IP ranges on the victim network. [menuPass](https://attack.mitre.org/group... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has enumerated DC servers using the command <code>net group "Domain Controllers" /domain</code>. The gr... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has enumerated domain controllers using `net group "Domain computers"` and `nltest /dclist`.(Citation... |
| G0019 | Naikon | [Naikon](https://attack.mitre.org/groups/G0019) has used a netbios scanner for remote machine identification.(Citation: Bitdefender Naikon April 2021) |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the in... |
| G0077 | Leafminer | [Leafminer](https://attack.mitre.org/groups/G0077) used Microsoft’s Sysinternals tools to gather detailed information about remote systems.(Citation: ... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used a tool to query Active Directory using LDAP, discovering information about computers l... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has queried Active Directory for computers using [AdFind](https://attack.mitre.org/software/S05... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into th... |
| G1015 | Scattered Spider | [Scattered Spider](https://attack.mitre.org/groups/G1015) can enumerate remote systems, such as VMware vCenter infrastructure.(Citation: CISA Scattere... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used [NBTscan](https://attack.mitre.org/software/S0590) and custom tools to discover remote systems... |
| G1024 | Akira | [Akira](https://attack.mitre.org/groups/G1024) uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.(... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) has used network scanning and enumeration tools, including [Ping](https://attack.mitre.org/software/... |
Associated Software (54)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) can enumerate computers and network devices.(Citation: Cyberreason Anchor December 2019) |
| S0233 | MURKYTOP | Malware | [MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to identify remote hosts on connected networks.(Citation: FireEye Periscope Mar... |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) uses the <code>net view</code> command for discovery.(Citation: ASERT Donot March 2018) |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) can enumerate and map ICS-specific systems in victim environments.(Citation: Gigamon Berser... |
| S1212 | RansomHub | Malware | [RansomHub](https://attack.mitre.org/software/S1212) can enumerate all accessible machines from the infected system.(Citation: Group-IB RansomHub FEB ... |
| S1229 | Havoc | Malware | [Havoc](https://attack.mitre.org/software/S1229) features a module capable of host enumeration.(Citation: Havoc Framework Documentation) |
| S1198 | Gomir | Malware | [Gomir](https://attack.mitre.org/software/S1198) probes arbitrary network endpoints for TCP connectivity.(Citation: Symantec Troll Stealer 2024) |
| S0365 | Olympic Destroyer | Malware | [Olympic Destroyer](https://attack.mitre.org/software/S0365) uses [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) to e... |
| S1159 | DUSTTRAP | Malware | [DUSTTRAP](https://attack.mitre.org/software/S1159) can use `ping` to identify remote hosts within the victim network.(Citation: Google Cloud APT41 20... |
| S1081 | BADHATCH | Malware | [BADHATCH](https://attack.mitre.org/software/S1081) can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.(Cita... |
| S0575 | Conti | Malware | [Conti](https://attack.mitre.org/software/S0575) has the ability to discover hosts on a target network.(Citation: CrowdStrike Wizard Spider October 2... |
| S0659 | Diavol | Malware | [Diavol](https://attack.mitre.org/software/S0659) can use the ARP table to find remote hosts to scan.(Citation: Fortinet Diavol July 2021) |
| S1068 | BlackCat | Malware | [BlackCat](https://attack.mitre.org/software/S1068) can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised... |
| S0694 | DRATzarus | Malware | [DRATzarus](https://attack.mitre.org/software/S0694) can search for other machines connected to compromised host and attempt to map the network.(Citat... |
| S0063 | SHOTPUT | Malware | [SHOTPUT](https://attack.mitre.org/software/S0063) has a command to list all servers in the domain, as well as one to locate domain controllers on a d... |
| S0696 | Flagpro | Malware | [Flagpro](https://attack.mitre.org/software/S0696) has been used to execute <code>net view</code> on a targeted system.(Citation: NTT Security Flagpro... |
| S0646 | SpicyOmelette | Malware | [SpicyOmelette](https://attack.mitre.org/software/S0646) can identify payment systems, payment gateways, and ATM systems in compromised environments.(... |
| S0125 | Remsec | Malware | [Remsec](https://attack.mitre.org/software/S0125) can ping or traceroute a remote host.(Citation: Kaspersky ProjectSauron Technical Analysis) |
| S0018 | Sykipot | Malware | [Sykipot](https://attack.mitre.org/software/S0018) may use <code>net view /domain</code> to display hostnames of available systems on a network.(Citat... |
| S0091 | Epic | Malware | [Epic](https://attack.mitre.org/software/S0091) uses the <code>net view</code> command on the victim’s machine.(Citation: Kaspersky Turla) |
References
- CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
- Stepanic, D.. (2020, January 13). Embracing offensive tooling: Building detections against Koadic using EQL. Retrieved November 17, 2024.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Frequently Asked Questions
What is T1018 (Remote System Discovery)?
T1018 is a MITRE ATT&CK technique named 'Remote System Discovery'. It belongs to the Discovery tactic(s). Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality...
How can T1018 be detected?
Detection of T1018 (Remote System Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1018?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1018?
Known threat groups using T1018 include: Indrik Spider, BlackByte, GALLIUM, APT3, Volt Typhoon, APT41, Dragonfly, menuPass.