{"id":"T1018","name":"Remote System Discovery","url":"https://attack.mitre.org/techniques/T1018","tactics":["discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0574","stix_id":"x-mitre-detection-strategy--9ec6dafe-3e93-4ebb-943e-26b84136f6a9","name":"Detection Strategy for Remote System Enumeration Behavior","url":"https://attack.mitre.org/detectionstrategies/DET0574","analytics":[{"id":"AN1583","stix_id":"x-mitre-analytic--498eb889-4468-4c55-9337-df219d5f142b","name":"Analytic 1583","description":"Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1583","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Define bursty execution patterns of enumeration commands (e.g., <30s)"},{"field":"CommandLinePattern","description":"Tunable per org’s scripting/IT tools (e.g., exclude SCCM, PsExec)"},{"field":"ParentProcess","description":"Flag suspicious process ancestry (e.g., Word.exe spawning net.exe)"}],"live":true,"detection_strategies":["DET0574"],"techniques":["T1018"]},{"id":"AN1584","stix_id":"x-mitre-analytic--f794d2f4-ad8e-4e11-b374-2c35f8ca38e9","name":"Analytic 1584","description":"Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1584","platforms":["Linux"],"log_source_references":[{"name":"auditd:EXECVE","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-execve"},{"name":"linux:syslog","channel":"network","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"TargetIPRange","description":"Tune for sensitive internal segments or known lateral targets"},{"field":"ShellContext","description":"Distinguish user-interactive enumeration vs. cronjob or baseline tooling"}],"live":true,"detection_strategies":["DET0574"],"techniques":["T1018"]},{"id":"AN1585","stix_id":"x-mitre-analytic--80c7f835-116d-4fa1-817a-08965efef16c","name":"Analytic 1585","description":"Execution of built-in or AppleScript-based system enumeration via `arp`, `netstat`, `ping`, and discovery of `/etc/hosts` contents.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1585","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"file_events","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"ExecutionUser","description":"Limit detection to suspicious users or automation contexts"},{"field":"CommandSignature","description":"Adapt for expected enumeration tooling used in IT"}],"live":true,"detection_strategies":["DET0574"],"techniques":["T1018"]},{"id":"AN1586","stix_id":"x-mitre-analytic--88041144-900d-4968-9e8a-8f1f63ae8417","name":"Analytic 1586","description":"ESXi shell or SSH access issuing `esxcli network diag ping` or viewing routing tables to identify connected hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1586","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"None","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"ESXCommandPattern","description":"Match specific diag/debug commands abused for recon"},{"field":"RemoteUserShell","description":"Detect unauthorized shell use or user context (e.g., root over SSH)"}],"live":true,"detection_strategies":["DET0574"],"techniques":["T1018"]},{"id":"AN1587","stix_id":"x-mitre-analytic--aad71d3e-93b0-4cb6-8240-274369f8ad34","name":"Analytic 1587","description":"Execution of discovery commands like `show cdp neighbors`, `show arp`, and other interface-level introspection on Cisco or Juniper devices.","url":"https://attack.mitre.org/detectionstrategies/DET0574#AN1587","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"syslog facility LOCAL7 or trap messages","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"CommandList","description":"Device-specific recon commands to monitor based on make/model"},{"field":"PrivLevel","description":"Trigger detection for privilege escalation prior to recon commands"}],"live":true,"detection_strategies":["DET0574"],"techniques":["T1018"]}],"live":true,"version":"1.0","techniques":["T1018"]}],"sigma_rules":[{"id":"10227522-8429-47e6-a301-f2b2d014e7ad","title":"Macos Remote System Discovery","author":"Alejandro Ortuno, oscd.community","status":"test","level":"informational","date":"2020-10-22","modified":"2021-11-27","description":"Detects the enumeration of other remote systems.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.discovery","attack.t1018"],"path":"rules/macos/process_creation/proc_creation_macos_remote_system_discovery.yml","techniques":["T1018"],"cves":[]},{"id":"11063ec2-de63-4153-935e-b1a8b9e616f1","title":"Linux Remote System Discovery","author":"Alejandro Ortuno, oscd.community","status":"test","level":"low","date":"2020-10-22","modified":"2021-11-27","description":"Detects the enumeration of other remote systems.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.discovery","attack.t1018"],"path":"rules/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml","techniques":["T1018"],"cves":[]},{"id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","title":"Net.EXE Execution","author":"Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)","status":"test","level":"low","date":"2019-01-16","modified":"2022-07-11","description":"Detects execution of \"Net.EXE\".","references":["https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/","https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html","https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html","https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","attack.t1049","attack.t1018","attack.t1135","attack.t1201","attack.t1069.001","attack.t1069.002","attack.t1087.001","attack.t1087.002","attack.lateral-movement","attack.t1021.002","attack.s0039","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml","techniques":["T1007","T1049","T1018","T1135","T1201","T1069.001","T1069.002","T1087.001","T1087.002","T1021.002"],"cves":[]},{"id":"1f6399cf-2c80-4924-ace1-6fcff3393480","title":"DirectorySearcher Powershell Exploitation","author":"frack113","status":"test","level":"medium","date":"2022-02-12","modified":null,"description":"Enumerates Active Directory to determine computers that are joined to the domain","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-15---enumerate-domain-computers-within-active-directory-using-directorysearcher"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1018"],"path":"rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml","techniques":["T1018"],"cves":[]},{"id":"26d3f0a2-f514-4a3f-a8a7-e7e48a8d9160","title":"PUA - Adidnsdump Execution","author":"frack113","status":"test","level":"low","date":"2022-01-01","modified":"2023-02-21","description":"This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed,\nUsee to Query/modify DNS records for Active Directory integrated DNS via LDAP\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-9---remote-system-discovery---adidnsdump"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018"],"path":"rules/windows/process_creation/proc_creation_win_python_adidnsdump.yml","techniques":["T1018"],"cves":[]},{"id":"36bed6b2-e9a0-4fff-beeb-413a92b86138","title":"Active Directory Computers Enumeration With Get-AdComputer","author":"frack113","status":"test","level":"low","date":"2022-03-17","modified":"2023-07-08","description":"Detects usage of the \"Get-AdComputer\" to enumerate Computers or properties within Active Directory.","references":["https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md","https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1018","attack.t1087.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml","techniques":["T1018","T1087.002"],"cves":[]},{"id":"4ebc877f-4612-45cb-b3a5-8e3834db36c9","title":"Webshell Hacking Activity Patterns","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-17","modified":"2023-11-09","description":"Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system\n","references":["https://youtu.be/7aemGhaE9ds?t=641"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"path":"rules/windows/process_creation/proc_creation_win_webshell_hacking.yml","techniques":["T1505.003","T1018","T1033","T1087"],"cves":[]},{"id":"62510e69-616b-4078-b371-847da438cc03","title":"Share And Session Enumeration Using Net.EXE","author":"Endgame, JHasenbusch (ported for oscd.community)","status":"stable","level":"low","date":"2018-10-30","modified":"2023-02-21","description":"Detects attempts to enumerate file shares, printer shares and sessions using \"net.exe\" with the \"view\" flag.","references":["https://eqllib.readthedocs.io/en/latest/analytics/b8a94d2f-dc75-4630-9d73-1edc6bd26fff.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018"],"path":"rules/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml","techniques":["T1018"],"cves":[]},{"id":"7638e5fe-600c-4289-a968-f49dd537ec7d","title":"HackTool - NetExec Execution","author":"Chirag Damani","status":"experimental","level":"high","date":"2026-03-29","modified":null,"description":"Detects execution of the hacktool NetExec.\nNetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration\nIn enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.\nThreat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.\n","references":["https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/","https://github.com/Pennyw0rth/NetExec","https://www.netexec.wiki/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018","attack.lateral-movement","attack.t1021"],"path":"rules/windows/process_creation/proc_creation_win_hktl_netexec.yml","techniques":["T1018","T1021"],"cves":[]},{"id":"903076ff-f442-475a-b667-4f246bcc203b","title":"Nltest.EXE Execution","author":"Arun Chauhan","status":"test","level":"low","date":"2023-02-03","modified":null,"description":"Detects nltest commands that can be used for information discovery","references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1016","attack.t1018","attack.t1482"],"path":"rules/windows/process_creation/proc_creation_win_nltest_execution.yml","techniques":["T1016","T1018","T1482"],"cves":[]},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Find information about network devices that is not stored in config files","references":["https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html"],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.discovery","attack.t1083","attack.t1201","attack.t1057","attack.t1018","attack.t1082","attack.t1016","attack.t1049","attack.t1033","attack.t1124"],"path":"rules/network/cisco/aaa/cisco_cli_discovery.yml","techniques":["T1083","T1201","T1057","T1018","T1082","T1016","T1049","T1033","T1124"],"cves":[]},{"id":"9a132afa-654e-11eb-ae93-0242ac130002","title":"PUA - AdFind Suspicious Execution","author":"Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community","status":"test","level":"high","date":"2021-02-02","modified":"2025-10-24","description":"Detects AdFind execution with common flags seen used during attacks","references":["https://www.joeware.net/freetools/tools/adfind/","https://thedfirreport.com/2020/05/08/adfind-recon/","https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/","https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018","attack.t1087.002","attack.t1482","attack.t1069.002","stp.1u"],"path":"rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml","techniques":["T1018","T1087.002","T1482","T1069.002"],"cves":[]},{"id":"bed2a484-9348-4143-8a8a-b801c979301c","title":"Webshell Detection With Command Line Keywords","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson","status":"test","level":"high","date":"2017-01-01","modified":"2026-07-14","description":"Detects certain command line parameters often used during reconnaissance activity via web shells","references":["https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html","https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/","https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"path":"rules/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml","techniques":["T1505.003","T1018","T1033","T1087"],"cves":[]},{"id":"cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5","title":"Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock","author":"frack113","status":"experimental","level":"medium","date":"2025-03-05","modified":null,"description":"Detects the use of the \"Get-ADComputer\" cmdlet in order to identify systems which are configured for unconstrained delegation.","references":["https://pentestlab.blog/2022/03/21/unconstrained-delegation/","https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.reconnaissance","attack.discovery","attack.credential-access","attack.t1018","attack.t1558","attack.t1589.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml","techniques":["T1018","T1558","T1589.002"],"cves":[]},{"id":"df55196f-f105-44d3-a675-e9dfb6cc2f2b","title":"Renamed AdFind Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-21","modified":"2025-02-26","description":"Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.","references":["https://www.joeware.net/freetools/tools/adfind/","https://thedfirreport.com/2020/05/08/adfind-recon/","https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/","https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018","attack.t1087.002","attack.t1482","attack.t1069.002"],"path":"rules/windows/process_creation/proc_creation_win_renamed_adfind.yml","techniques":["T1018","T1087.002","T1482","T1069.002"],"cves":[]},{"id":"f8ad2e2c-40b6-4117-84d7-20b89896ab23","title":"Suspicious Scan Loop Network","author":"frack113","status":"test","level":"medium","date":"2022-03-12","modified":null,"description":"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md","https://ss64.com/nt/for.html","https://ss64.com/ps/foreach-object.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059","attack.discovery","attack.t1018"],"path":"rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml","techniques":["T1059","T1018"],"cves":[]},{"id":"fa3c117a-bc0d-416e-a31b-0c0e80653efb","title":"Chopper Webshell Process Pattern","author":"Florian Roth (Nextron Systems), MSTI (query)","status":"test","level":"high","date":"2022-10-01","modified":null,"description":"Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells","references":["https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.discovery","attack.t1505.003","attack.t1018","attack.t1033","attack.t1087"],"path":"rules/windows/process_creation/proc_creation_win_webshell_chopper.yml","techniques":["T1505.003","T1018","T1033","T1087"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-0282","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-38035","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}