MITRE description

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.(Citation: Trellix Rnasomhouse 2024) Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

CVE-2021-40449

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-11-03 Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure
2026-10-30 Microsoft Threat Intelligence: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
2026-10-30 Darktrace: CikaBika Bot: Inside a Discord RAT Campaign
2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-10-19 Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
2026-10-15 Google Threat Intelligence: Investigating Ephemeral Supply Chain Tampering
2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-10-02 Group-IB: Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
2026-09-25 Google Threat Intelligence: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft

Showing the 10 most recent of 11.

Detection coverage

SigmaHQ community rules

Potential Pikabot Discovery Activity (emerging-threats)
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet (threat-hunting)
OpenCanary - SNMP OID Request (core)
System Network Discovery - Linux (core)
System Network Discovery - macOS (core)
Cisco Discovery (core)
Suspicious Network Connection to IP Lookup Service APIs (core)
Firewall Configuration Discovery Via Netsh.EXE (core)
Nltest.EXE Execution (core)
Potential Recon Activity Via Nltest.EXE (core)
Suspicious Network Command (core)

Elastic and Splunk rules

Suspicious Instance Metadata Service (IMDS) API Command Line Execution (elastic)
Suspicious Instance Metadata Service (IMDS) API Request (elastic)
DNS Enumeration Detected via Defend for Containers (elastic)
Linux External IP Address Discovery via Curl (elastic)
Potential Meterpreter Reverse Shell (elastic)
Suspicious System Commands Executed by Previously Unknown Executable (elastic)
Discovery Command Output Written to Suspicious File (elastic)
DNS Request for IP Lookup Service via Unsigned Binary (elastic)
External IP Address Discovery via Curl (elastic)
System and Network Configuration Check (elastic)
Unusual Linux Network Configuration Discovery (elastic)
Wireless Credential Dumping using Netsh Command (elastic)
Active Directory Discovery using AdExplorer (elastic)
AdFind Command Activity (elastic)
System Public IP Discovery via DNS Query (elastic)
PowerShell Suspicious Discovery Related Windows API Functions (elastic)
Enumeration Command Spawned via WMIPrvSE (elastic)
Suspicious PDF Reader Child Process (elastic)
Suspicious JetBrains TeamCity Child Process (elastic)
Suspicious MS Office Child Process (elastic)
System Hosts File Access (elastic)
Discovery of Internet Capabilities via Built-in Tools (elastic)
Deprecated - PowerShell Script with Discovery Capabilities (elastic)
External IP Lookup from Non-Browser Process (elastic)
Remote System Discovery Commands (elastic)

Showing 25 of 38.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.