System Network Connections Discovery

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download^[4]

Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.^[5]

APT1 used the net use command to get a listing on network connections.^[6]

APT3 has a tool that can enumerate current network connections.^[7][8][9]

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.^[10]

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.^[11]

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.^[12][13]

Aria-body has the ability to gather TCP and UDP table status listings.^[14]

Babuk can use "WNetOpenEnumW" and "WNetEnumResourceW" to enumerate files in network resources for encryption.^[15]

BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.^[16]

BlackEnergy has gathered information about local network connections using netstat.^[17][18]

Carbon uses the netstat -r and netstat -an commands.^[19]

Chimera has used netstat -ano | findstr EST to discover network connections.^[20]

Cobalt Strike can produce a sessions report from compromised hosts.^[21]

Comnie executes the netstat -ano command.^[22]

Conti can enumerate routine network connections from a compromised host.^[23]

CrackMapExec can discover active sessions for a targeted system.^[24]

Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.^[25]

Dtrack can collect network and active connection information.^[26]

The discovery modules used with Duqu can collect information on network connections.^[27]

Egregor can enumerate all connected drives.^[28]

Empire can enumerate the current network connections of a host.^[29]

Epic uses the net use, net session, and netstat commands to gather information on network connections.^[30][31]

GALLIUM used netstat -oan to obtain information about the victim network connections.^[32]

GravityRAT uses the netstat command to find open ports on the victim’s machine.^[33]

jRAT can list network connections.^[34]

Ke3chang performs local network connection discovery using netstat.^[35][36]

Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.^[37]

Lucifer can identify the IP and port numbers for all remote connections from the compromised host.^[38]

Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.^[39]

Maze has used the "WNetOpenEnumW", "WNetEnumResourceW", "WNetCloseEnum" and "WNetAddConnection2W" functions to enumerate the network resources on the infected machine.^[40]

menuPass has used net use to conduct connectivity checks to machines.^[41]

After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server. ^[42]

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.^[43]

Mustang Panda has used netstat -ano to determine network connection information.^[44]

nbtstat can be used to discover current NetBIOS sessions.

Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.^[45]

netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.^[46]

NETWIRE can capture session logon details from a compromised host.^[47]

OilRig has used netstat -an on a victim to get a listing of network connections.^[48]

Okrum was seen using NetSess to discover NetBIOS sessions.^[49]

Operation Wocao has collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.^[50]

OSInfo enumerates the current network connections similar to net use .^[7]

PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.^[51]

Poseidon Group obtains and saves information about victim network interfaces and addresses.^[52]

PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.^[53]

POWRUNER may collect active network connections by running netstat -an on a victim.^[54]

Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.^[55]

QakBot can use netstat to enumerate current network connections.^[56]

Ramsay can use netstat to enumerate network connections.^[57]

RATANKBA uses netstat -ano to search for specific IP address ranges.^[58]

RedLeaves can enumerate drives and Remote Desktop sessions.^[59]

Remsec can obtain a list of active connections and open ports.^[60]

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.^[61][62]

ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.^[63]

SHOTPUT uses netstat to list TCP connection status.^[64]

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.^[65]

Sliver can collect network connection information.^[66]

SLOTHFULMEDIA can enumerate open ports on a victim machine.^[67]

SpeakUp uses the arp -a command. ^[68]

Sykipot may use netstat -ano to display active network connections.^[69]

TeamTNT runs netstat -anp to search for rival malware connections.^[70] TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.^[71]

Threat Group-3390 has used net use to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.^[72]

Trojan.Karagany can use netstat to collect a list of network connections.^[73]

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.^[74]

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands.^[30][75] Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.^[76]

USBferry can use netstat and nbtstat to detect active network connections.^[74]

Volgmer can gather information about TCP connection state.^[77]

Waterbear can use API hooks on "GetExtendedTcpTable" to retrieve a table containing a list of TCP endpoints available to the application.^[78]

Zebrocy uses netstat -aon to gather network connection information.^[79]