MITRE ATT&CKtechnique

T1016 System Network Configuration Discovery

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.7
Created
2017-05-31

Description

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route. Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface). On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address. Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · subtechnique of (2)

  • T1016.002 Wi-Fi Discovery sub-technique
  • T1016.001 Internet Connection Discovery sub-technique

Referenced by MITRE ATT&CK · uses (292)

  • S9050 Vidar software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • G1057 ShinyHunters group
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9035 LAMEHUG software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9003 evilginx2 software (tool)
  • S1248 XORIndex Loader software (malware)
  • S1249 HexEval Loader software (malware)
  • S1245 InvisibleFerret software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1229 Havoc software (malware)
  • S1228 PUBLOAD software (malware)
  • C0056 RedPenguin campaign
  • S1210 Sagerunex software (malware)
  • G1045 Salt Typhoon group
  • S1204 cd00r software (malware)
  • S1203 J-magic software (malware)
  • S1196 Troll Stealer software (malware)
  • S1198 Gomir software (malware)
  • G1044 APT42 group
  • S1184 BOLDMOVE software (malware)
Show all 292 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-309 Network Topology Mapping attack pattern

References