System Network Connections Discovery

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download^[5]

Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.^[6]

APT1 used the net use command to get a listing on network connections.^[7]

APT3 has a tool that can enumerate current network connections.^[8][9][10]

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.^[11]

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.^[12]

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.^[13][14]

APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.^[15]

Aria-body has the ability to gather TCP and UDP table status listings.^[16]

Babuk can use "WNetOpenEnumW" and "WNetEnumResourceW" to enumerate files in network resources for encryption.^[17]

BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.^[18]

BADHATCH can execute netstat.exe -f on a compromised machine.^[19]

BlackEnergy has gathered information about local network connections using netstat.^[20][21]

Carbon uses the netstat -r and netstat -an commands.^[22]

CharmPower can use netsh wlan show profiles to list specific Wi-Fi profile details.^[23]

Chimera has used netstat -ano | findstr EST to discover network connections.^[24]

Cobalt Strike can produce a sessions report from compromised hosts.^[25]

Comnie executes the netstat -ano command.^[26]

Conti can enumerate routine network connections from a compromised host.^[27]

CrackMapExec can discover active sessions for a targeted system.^[28]

Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.^[29]

Dtrack can collect network and active connection information.^[30]

The discovery modules used with Duqu can collect information on network connections.^[31]

Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log "Microsoft-Windows-TerminalServices-RDPClient/Operational"(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.^[32]

Egregor can enumerate all connected drives.^[33]

Empire can enumerate the current network connections of a host.^[34]

Epic uses the net use, net session, and netstat commands to gather information on network connections.^[35][36]

FIN13 has used netstat and other net commands for network reconnaissance efforts.^[37]

Flagpro has been used to execute netstat -ano on a compromised host.^[38]

FRP can use a dashboard and U/I to display the status of connections from the FRP client and server.^[39]

During FunnyDream, the threat actors used netstat to discover network connections on remote systems.^[40]

GALLIUM used netstat -oan to obtain information about the victim network connections.^[41]

GravityRAT uses the netstat command to find open ports on the victim’s machine.^[42]

HEXANE has used netstat to monitor connections to specific ports.^[43]

INC Ransom has used RDP to test network connections.^[44]

jRAT can list network connections.^[45]

Ke3chang performs local network connection discovery using netstat.^[46][47]

KONNI has used net session on the victim's machine.^[48]

KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.^[49]

Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.^[50]

Lazarus Group has used net use to identify and establish a network connection with a remote host.^[51]

Lizar has a plugin to retrieve information about all active network sessions on the infected server.^[52]

Lucifer can identify the IP and port numbers for all remote connections from the compromised host.^[53]

LunarWeb can enumerate system network connections.^[54]

Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.^[55]

Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.^[56]

Magic Hound has used quser.exe to identify existing RDP connections.^[57]

Maze has used the "WNetOpenEnumW", "WNetEnumResourceW", "WNetCloseEnum" and "WNetAddConnection2W" functions to enumerate the network resources on the infected machine.^[58]

menuPass has used net use to conduct connectivity checks to machines.^[59]

After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server. ^[60]

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.^[61]

Mustang Panda has used netstat -ano to determine network connection information.^[62]

nbtstat can be used to discover current NetBIOS sessions.

Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.^[63]

netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.^[64]

NETWIRE can capture session logon details from a compromised host.^[65]

OilRig has used netstat -an on a victim to get a listing of network connections.^[66]

Okrum was seen using NetSess to discover NetBIOS sessions.^[67]

During Operation CuckooBees, the threat actors used the net session, net use, and netstat commands as part of their advanced reconnaissance.^[68]

During Operation Wocao, threat actors collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.^[69]

OSInfo enumerates the current network connections similar to net use .^[8]

Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.^[70]

PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.^[71]

Poseidon Group obtains and saves information about victim network interfaces and addresses.^[72]

PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.^[73]

POWRUNER may collect active network connections by running netstat -an on a victim.^[74]

Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.^[75]

PyDCrypt has used netsh to find RPC connections on remote machines.^[76]

QakBot can use netstat to enumerate current network connections.^[77][78]

Ramsay can use netstat to enumerate network connections.^[79]

RATANKBA uses netstat -ano to search for specific IP address ranges.^[80]

RedLeaves can enumerate drives and Remote Desktop sessions.^[81]

Remsec can obtain a list of active connections and open ports.^[82]

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.^[83][84]

Sardonic has the ability to execute the netstat command.^[85]

ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.^[86]

SHOTPUT uses netstat to list TCP connection status.^[87]

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.^[88]

Sliver can collect network connection information.^[89]

SLOTHFULMEDIA can enumerate open ports on a victim machine.^[90]

SpeakUp uses the arp -a command. ^[91]

Sykipot may use netstat -ano to display active network connections.^[92]

TeamTNT has run netstat -anp to search for rival malware connections.^[93] TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.^[94]

Threat Group-3390 has used net use and netstat to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.^[95]

ToddyCat has used netstat -anop tcp to discover TCP connections to compromised hosts.^[96]

Torisma can use WTSEnumerateSessionsW to monitor remote desktop connections.^[97]

Trojan.Karagany can use netstat to collect a list of network connections.^[98]

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.^[99]

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands.^[35][100] Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.^[101]

USBferry can use netstat and nbtstat to detect active network connections.^[99]

Volgmer can gather information about TCP connection state.^[102]

Volt Typhoon has used netstat -ano on compromised hosts to enumerate network connections.^[103][104]

Waterbear can use API hooks on GetExtendedTcpTable to retrieve a table containing a list of TCP endpoints available to the application.^[105]

Zebrocy uses netstat -aon to gather network connection information.^[106]