System Network Configuration Discovery: Internet Connection Discovery (T1016.001)

Tactic: Discovery · Platforms: Windows, Linux, macOS, ESXi

The interactive view maps 1 detection strategy, 11 threat groups, 13 software entries, 2 campaigns to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of System Network Configuration Discovery (T1016).

Overview

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth.

Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.

Explore

• Open T1016.001 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1016.001
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan