Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Field | Description |
|---|---|
| TimeWindow | Define bursty execution patterns of enumeration commands (e.g., <30s) |
| CommandLinePattern | Tunable per org’s scripting/IT tools (e.g., exclude SCCM, PsExec) |
| ParentProcess | Flag suspicious process ancestry (e.g., Word.exe spawning net.exe) |
Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:EXECVE | execve |
| Network Connection Creation (DC0082) | linux:syslog | network |
| Field | Description |
|---|---|
| TargetIPRange | Tune for sensitive internal segments or known lateral targets |
| ShellContext | Distinguish user-interactive enumeration vs. cronjob or baseline tooling |
Execution of built-in or AppleScript-based system enumeration via arp, netstat, ping, and discovery of /etc/hosts contents.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | process |
| File Access (DC0055) | macos:osquery | file_events |
| Field | Description |
|---|---|
| ExecutionUser | Limit detection to suspicious users or automation contexts |
| CommandSignature | Adapt for expected enumeration tooling used in IT |
ESXi shell or SSH access issuing esxcli network diag ping or viewing routing tables to identify connected hosts.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | esxi:hostd | None |
| Field | Description |
|---|---|
| ESXCommandPattern | Match specific diag/debug commands abused for recon |
| RemoteUserShell | Detect unauthorized shell use or user context (e.g., root over SSH) |
Execution of discovery commands like show cdp neighbors, show arp, and other interface-level introspection on Cisco or Juniper devices.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:syslog | syslog facility LOCAL7 or trap messages |
| Field | Description |
|---|---|
| CommandList | Device-specific recon commands to monitor based on make/model |
| PrivLevel | Trigger detection for privilege escalation prior to recon commands |