Description
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected. The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals. Cloud providers may have different ways in which their virtual networks operate.(Citation: Amazon AWS VPC Guide)(Citation: Microsoft Azure Virtual Network Overview)(Citation: Google VPC Overview) Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services.
Utilities and commands that acquire this information include netstat, "net use," and "net session" with Net. In Mac and Linux, netstat and lsof can be used to list current connections. who -a and w can be used to show which users are currently logged in, similar to "net session". Additionally, built-in features native to network devices and Network Device CLI may be used (e.g. show ip sockets, show tcp brief).(Citation: US-CERT-TA18-106A) On ESXi servers, the command esxi network ip connection list can be used to list active network connections.(Citation: Sygnia ESXi Ransomware 2025)
Platforms
Threat Groups (32)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.(Ci... |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used <code>netstat -oan</code> to obtain information about the victim network connections.(Citation: ... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that can enumerate current network connections.(Citation: Symantec Buckeye)(Citation: FireEye... |
| G0018 | admin@338 | [admin@338](https://attack.mitre.org/groups/G0018) actors used the following command following exploitation of a machine with [LOWBALL](https://attack... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used `netstat -ano` on compromised hosts to enumerate network connections.(Citation: Joint ... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) has enumerated IP addresses of network resources and used the <code>netstat</code> command as part of n... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has used <code>net use</code> to conduct connectivity checks to machines.(Citation: PWC Cloud Hopper... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) used the <code>netstat -anpo tcp</code> command to display TCP connections on the victim's machine.(Cit... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used a PowerShell backdoor to check for Skype connections on the target machine.(Citation: Tre... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has run <code>netstat -anp</code> to search for rival malware connections.(Citation: Trend Micro Team... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) had gathered user, IP address, and server data related to RDP sessions on a compromised host. I... |
| G0138 | Andariel | [Andariel](https://attack.mitre.org/groups/G0138) has used the <code>netstat -naop tcp</code> command to display TCP connections on a victim's machine... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has used <code>netstat -ano</code> to determine network connection information.(Citation: Avira... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used <code>netstat -an</code> on a victim to get a listing of network connections.(Citation: Palo ... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) has tested if the localhost network is available and other connection capability on an infecte... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) performs local network connection discovery using <code>netstat</code>.(Citation: Mandiant Operation... |
| G0006 | APT1 | [APT1](https://attack.mitre.org/groups/G0006) used the <code>net use</code> command to get a listing on network connections.(Citation: Mandiant APT1) |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover active local network connections using the <code>netstat -an... |
| G0033 | Poseidon Group | [Poseidon Group](https://attack.mitre.org/groups/G0033) obtains and saves information about victim network interfaces and addresses.(Citation: Kaspers... |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has used commands such as `netstat` to identify system network connections.(Citation: Cisco Lot... |
Associated Software (61)
| ID | Name | Type | Context |
|---|---|---|---|
| S0678 | Torisma | Malware | [Torisma](https://attack.mitre.org/software/S0678) can use `WTSEnumerateSessionsW` to monitor remote desktop connections.(Citation: McAfee Lazarus Nov... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may collect active network connections by running <code>netstat -an</code> on a victim.(Citation: ... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) can use [netstat](https://attack.mitre.org/software/S0104), [Arp](https://attack.mitre.org/softwa... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `netstat` command.(Citation: Bitdefender Sardonic Aug 2021) |
| S0153 | RedLeaves | Malware | [RedLeaves](https://attack.mitre.org/software/S0153) can enumerate drives and Remote Desktop sessions.(Citation: PWC Cloud Hopper Technical Annex Apri... |
| S0237 | GravityRAT | Malware | [GravityRAT](https://attack.mitre.org/software/S0237) uses the <code>netstat</code> command to find open ports on the victim’s machine.(Citation: Talo... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) can capture session logon details from a compromised host.(Citation: FireEye NETWIRE March 2019) |
| S1032 | PyDCrypt | Malware | [PyDCrypt](https://attack.mitre.org/software/S1032) has used [netsh](https://attack.mitre.org/software/S0108) to find RPC connections on remote machin... |
| S0456 | Aria-body | Malware | [Aria-body](https://attack.mitre.org/software/S0456) has the ability to gather TCP and UDP table status listings.(Citation: CheckPoint Naikon May 2020... |
| S1081 | BADHATCH | Malware | [BADHATCH](https://attack.mitre.org/software/S1081) can execute `netstat.exe -f` on a compromised machine.(Citation: BitDefender BADHATCH Mar 2021) |
| S1228 | PUBLOAD | Malware | [PUBLOAD](https://attack.mitre.org/software/S1228) has used several commands executed in sequence via `cmd` in a short interval to gather information ... |
| S1060 | Mafalda | Malware | [Mafalda](https://attack.mitre.org/software/S1060) can use the <code>GetExtendedTcpTable</code> function to retrieve information about established TCP... |
| S0180 | Volgmer | Malware | [Volgmer](https://attack.mitre.org/software/S0180) can gather information about TCP connection state.(Citation: Symantec Volgmer Aug 2014) |
| S0439 | Okrum | Malware | [Okrum](https://attack.mitre.org/software/S0439) was seen using NetSess to discover NetBIOS sessions.(Citation: ESET Okrum July 2019) |
| S0575 | Conti | Malware | [Conti](https://attack.mitre.org/software/S0575) can enumerate routine network connections from a compromised host.(Citation: CarbonBlack Conti July 2... |
| S0532 | Lucifer | Malware | [Lucifer](https://attack.mitre.org/software/S0532) can identify the IP and port numbers for all remote connections from the compromised host.(Citation... |
| S0089 | BlackEnergy | Malware | [BlackEnergy](https://attack.mitre.org/software/S0089) has gathered information about local network connections using [netstat](https://attack.mitre.o... |
| S0063 | SHOTPUT | Malware | [SHOTPUT](https://attack.mitre.org/software/S0063) uses [netstat](https://attack.mitre.org/software/S0104) to list TCP connection status.(Citation: Pa... |
| S0696 | Flagpro | Malware | [Flagpro](https://attack.mitre.org/software/S0696) has been used to execute <code>netstat -ano</code> on a compromised host.(Citation: NTT Security Fl... |
| S0638 | Babuk | Malware | [Babuk](https://attack.mitre.org/software/S0638) can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryptio... |
References
- Amazon. (n.d.). What Is Amazon VPC?. Retrieved October 6, 2019.
- Annamalai, N., Casey, C., Almeida, M., et. al.. (2019, June 18). What is Azure Virtual Network?. Retrieved October 6, 2019.
- Google. (2019, September 23). Virtual Private Cloud (VPC) network overview. Retrieved October 6, 2019.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
- Zhongyuan Hau (Aaron), Ren Jie Yow, and Yoav Mazor. (2025, January 21). ESXi Ransomware Attacks: Stealthy Persistence through. Retrieved March 27, 2025.
Frequently Asked Questions
What is T1049 (System Network Connections Discovery)?
T1049 is a MITRE ATT&CK technique named 'System Network Connections Discovery'. It belongs to the Discovery tactic(s). Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. An...
How can T1049 be detected?
Detection of T1049 (System Network Connections Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1049?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1049?
Known threat groups using T1049 include: APT38, GALLIUM, APT3, admin@338, Volt Typhoon, APT41, menuPass, APT32.