MITRE ATT&CKtechnique

T1018 Remote System Discovery

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
3.6
Created
2017-05-31

Description

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (108)

  • G1058 The Gentlemen group
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S9045 BACKUPOSINT v9.0 APEX PREDATOR software (malware)
  • G1057 ShinyHunters group
  • S9042 CanisterWorm software (malware)
  • C0061 Operation Digital Eye campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1229 Havoc software (malware)
  • S1212 RansomHub software (malware)
  • G1045 Salt Typhoon group
  • C0049 Leviathan Australian Intrusions campaign
  • S1198 Gomir software (malware)
  • G1043 BlackByte group
  • G1040 Play group
  • S1159 DUSTTRAP software (malware)
  • S1146 MgBot software (malware)
  • G1030 Agrius group
  • G1024 Akira group
  • G1022 ToddyCat group
  • C0028 2015 Ukraine Electric Power Attack campaign
  • S1081 BADHATCH software (malware)
  • G1017 Volt Typhoon group
  • G1015 Scattered Spider group
  • C0025 2016 Ukraine Electric Power Attack campaign
  • C0024 SolarWinds Compromise campaign
  • S1070 Black Basta software (malware)
  • S1068 BlackCat software (malware)
Show all 108 ›

Referenced by CAPEC · att&ck technique (1)

References