T1018 Remote System Discovery

Technique

T1018

Tactics

Discovery

Research, 90 days

4

KEV CVEs mapped

2

SigmaHQ rules

17

Elastic, Splunk

38

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1018

MITRE description

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2025-0282
• CVE-2023-38035

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
• 2026-10-19 Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
• 2026-08-12 Huntress: Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Detection coverage

SigmaHQ community rules

• Net.EXE Execution (threat-hunting)
• Linux Remote System Discovery (core)
• Macos Remote System Discovery (core)
• Cisco Discovery (core)
• DirectorySearcher Powershell Exploitation (core)
• Active Directory Computers Enumeration With Get-AdComputer (core)
• Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock (core)
• HackTool - NetExec Execution (core)
• Share And Session Enumeration Using Net.EXE (core)
• Nltest.EXE Execution (core)
• PUA - AdFind Suspicious Execution (core)
• PUA - Adidnsdump Execution (core)
• Renamed AdFind Execution (core)
• Suspicious Scan Loop Network (core)
• Chopper Webshell Process Pattern (core)
• Webshell Hacking Activity Patterns (core)
• Webshell Detection With Command Line Keywords (core)

Elastic and Splunk rules

• DNS Enumeration Detected via Defend for Containers (elastic)
• Potential Network Scan Executed From Host (elastic)
• Potential Subnet Scanning Activity from Compromised Host (elastic)
• Spike in Firewall Denies (elastic)
• ICMP Timestamp or Information Request from the Internet (elastic)
• Potential Network Sweep Detected (elastic)
• Potential Enumeration via Active Directory Web Service (elastic)
• Active Directory Discovery using AdExplorer (elastic)
• AdFind Command Activity (elastic)
• Enumerating Domain Trusts via DSQUERY.EXE (elastic)
• Enumerating Domain Trusts via NLTEST.EXE (elastic)
• Newly Seen Commonly Abused Network Scanner (elastic)
• Enumeration Command Spawned via WMIPrvSE (elastic)
• System Hosts File Access (elastic)
• Windows Network Enumeration (elastic)
• Remote System Discovery Commands (elastic)
• Cisco IOS XE Remote Access Probe Burst (splunk)
• Domain Controller Discovery with Nltest (splunk)
• Domain Controller Discovery with Wmic (splunk)
• GetAdComputer with PowerShell (splunk)
• GetAdComputer with PowerShell Script Block (splunk)
• GetDomainComputer with PowerShell (splunk)
• GetDomainComputer with PowerShell Script Block (splunk)
• GetDomainController with PowerShell (splunk)
• GetDomainController with PowerShell Script Block (splunk)

Showing 25 of 38.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.