Edit

Discovery Activities (MITRE ATT&CK: T1016, T1083, T1046)

Note: Sometimes, you may have to customise the queries to your environment. Also, queries will only work if the data is available.

Discovery Activities (MITRE ATT&CK: T1016, T1083, T1046)

Overview:

Discovery tactics involve gathering information about the network, system, and security settings. Adversaries often use built-in tools to map out the environment and plan further attacks, such as lateral movement.

25 Example Queries for Actor Discovery Detection:

  1. Detect Network Enumeration via Netstat Netstat reveals active connections, open ports, and listening services.

DeviceProcessEvents | where FileName == "netstat.exe" | summarize count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

  1. Monitor the Use of Ipconfig for Network Discovery Ipconfig provides detailed information about network interfaces.

DeviceProcessEvents | where FileName == "ipconfig.exe" | summarize count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

  1. Track Nslookup for DNS Reconnaissance Nslookup is used to query DNS records, revealing internal services.

DeviceProcessEvents | where FileName == "nslookup.exe" | summarize count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

  1. Detect ARP Scans for Network Mapping Arp scans are used to discover devices on the same network segment.

DeviceProcessEvents | where FileName == "arp.exe" | summarize count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

  1. Monitor the Use of Nbtstat for Network Resource Enumeration Nbtstat queries NetBIOS over TCP/IP to reveal network resources.

DeviceProcessEvents | where FileName == "nbtstat.exe" | summarize count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

  1. Track Use of Whoami for Privilege Discovery Whoami is often used to check the current user’s privileges.

DeviceProcessEvents | where FileName == "whoami.exe" | summarize count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

  1. Detect PowerShell Use for Active Directory Enumeration Attackers may use PowerShell to enumerate AD objects and user groups.

  1. Monitor the Use of Net View for Listing Network Shares Net view lists available shares on the network, often used by attackers.

  1. Track Execution of Tasklist for Process Enumeration Tasklist is used to list all running processes on a system.

  1. Detect Execution of Systeminfo for System Information Discovery Systeminfo provides information about the operating system and hardware.

  1. Monitor Execution of Net Use for Drive Mapping Net use can be used to connect to network drives and shares.

  1. Track WMIC Commands for System Discovery WMIC can retrieve information about operating systems, processes, and services.

  1. Detect Use of Ping for Host Discovery Ping is often used to test connectivity and discover active hosts.

  1. Monitor Execution of Route for Network Route Discovery Route.exe can display or modify the IP routing table.

  1. Detect Use of Getmac for MAC Address Discovery Getmac retrieves the MAC addresses of network adapters.

  1. Monitor Unusual SMB Traffic for Network Enumeration SMB traffic may be indicative of network reconnaissance activities.

  1. Track Execution of Reg.exe for Registry Enumeration Reg.exe is used to query or modify Windows registry entries.

  1. Detect Use of NetSh for Network Configuration Changes NetSh can be used to query or modify network configurations.

  1. Monitor Execution of PowerShell Network Discovery Scripts PowerShell scripts can perform various network discovery tasks.

  1. Detect Use of Network Sniffing Tools (Tcpdump, Wireshark) Network sniffing tools can be used for passive network reconnaissance.

  1. Monitor the Use of PsExec for Remote Execution PsExec is often used to execute commands remotely across the network.

  1. Track Use of PowerShell Remoting Commands PowerShell remoting commands such as New-PSSession may indicate lateral movement attempts.

  1. Monitor Netstat for Port and Connection Enumeration Netstat is used to view active network connections and ports.

  1. Detect DNS Query Tools for Domain Discovery (Nslookup, Dig) DNS query tools like nslookup and dig are used for DNS reconnaissance.

  1. Track Use of GPResult for Group Policy Enumeration GPResult provides details about applied Group Policy settings.

PreviousDetecting Malware Infection (MITRE ATT&CK: T1566, T1059)NextCredential Theft (MITRE ATT&CK: T1003, T1078)

Last updated