T1016 System Network Configuration Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099),…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- OpenCanary - SNMP OID Requesthightest · opencanary
- Potential Pikabot Discovery Activityhightest · windows
- Potential Recon Activity Via Nltest.EXEmediumtest · windows
- Suspicious Network Connection to IP Lookup Service APIsmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.