MITRE ATT&CKsub-technique

T1016.001 Internet Connection Discovery

Published 2021-03-17 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Windows, Linux, macOS, ESXi
Version
1.2
Created
2021-03-17

Description

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1016 System Network Configuration Discovery technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (26)

  • S1229 Havoc software (malware)
  • S1228 PUBLOAD software (malware)
  • S1107 NKAbuse software (malware)
  • G1018 TA2541 group
  • G1016 FIN13 group
  • G1017 Volt Typhoon group
  • C0024 SolarWinds Compromise campaign
  • S1066 DarkTortilla software (malware)
  • S1065 Woody RAT software (malware)
  • S1049 SUGARUSH software (malware)
  • C0014 Operation Wocao campaign
  • S0691 Neoichor software (malware)
  • S0686 QuietSieve software (malware)
  • S0663 SysUpdate software (malware)
  • S0650 QakBot software (malware)
  • S0597 GoldFinder software (malware)
  • G0125 HAFNIUM group
  • S0448 Rising Sun software (malware)
  • G1001 HEXANE group
  • S0284 More_eggs software (malware)
  • G0061 FIN8 group
  • G0059 Magic Hound group
  • G0010 Turla group
  • G0016 APT29 group
  • G0030 Lotus Blossom group
  • G0047 Gamaredon Group group