System Network Configuration Discovery: Internet Connection Discovery

ID Name
T1016.001 Internet Connection Discovery
T1016.002 Wi-Fi Discovery

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites.

Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.

ID: T1016.001
Sub-technique of:  T1016
Tactic: Discovery
Platforms: Linux, Windows, macOS
Permissions Required: User
Version: 1.0
Created: 17 March 2021
Last Modified: 25 March 2021

Procedure Examples

ID Name Description
G0016 APT29

APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.[1]

S1066 DarkTortilla

DarkTortilla can check for internet connectivity by issuing HTTP GET requests.[2]

G1016 FIN13

FIN13 has used Ping and tracert for network reconnaissance efforts.[3]

G0061 FIN8

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.[4]

G0047 Gamaredon Group

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as CSIDL_SYSTEM\cmd.exe /c ping -n 1.[5]

S0597 GoldFinder

GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.[6]

G0125 HAFNIUM

HAFNIUM has checked for network connectivity from a compromised host using ping, including attempts to contact google[.]com.[7]

G1001 HEXANE

HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.[8]

G0059 Magic Hound

Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.[9]

S0284 More_eggs

More_eggs has used HTTP GET requests to check internet connectivity.[10]

S0691 Neoichor

Neoichor can check for Internet connectivity by contacting bing[.]com with the request format bing[.]com?id=<GetTickCount>.[11]

C0014 Operation Wocao

During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.[12]

S0650 QakBot

QakBot can measure the download speed on a targeted host.[13]

S0686 QuietSieve

QuietSieve can check C2 connectivity with a ping to 8.8.8.8 (Google public DNS).[14]

S0448 Rising Sun

Rising Sun can test a connection to a specified network IP address over a specified port number.[15]

C0024 SolarWinds Compromise

During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.[6]

S1049 SUGARUSH

SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.[16]

S0663 SysUpdate

SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.[17]

G1018 TA2541

TA2541 has run scripts to check internet connectivity from compromised hosts. [18]

G0010 Turla

Turla has used tracert to check internet connectivity.[19]

S1065 Woody RAT

Woody RAT can make Ping GET HTTP requests to its C2 server at regular intervals for network connectivity checks.[20]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments that may check for Internet connectivity on compromised systems.

DS0009 Process Process Creation

Monitor for executed processes (such as tracert or ping) that may check for Internet connectivity on compromised systems.

References