MITRE ATT&CKtechnique

T0840 Network Connection Enumeration

Published 2020-05-21 Modified 2026-10-13 Official page ↗

Domain: ics
Tactics: Discovery
Platforms: Embedded, Windows, Linux, Network Devices
Version: 1.2
Created: 2020-05-21

Description

Adversaries may perform network connection enumeration to discover information about device communication patterns. If an adversary can inspect the state of a network connection with tools, such as Netstat, in conjunction with System Firmware, then they can determine the role of certain devices on the network . The adversary can also use Network Sniffing to watch network traffic for details about the source, destination, protocol, and content.

Tactic · MITRE ATT&CK (1)

TA0102 Discovery tactic

Referenced by MITRE ATT&CK · mitigates (1)

M0816 Mitigation Limited or Not Effective mitigation

Referenced by MITRE ATT&CK · uses (3)

C0063 2025 Poland Wiper Attacks campaign
S0605 EKANS software (malware)
S0604 Industroyer software (malware)

References

https://attack.mitre.org/wiki/Technique/T1049 MITRE
https://en.wikipedia.org/wiki/Netstat Netstat