Procedure examples

TrickBot can enumerate computers and network devices.

MURKYTOP has the capability to identify remote hosts on connected networks.

yty uses the net view command for discovery.

Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.

RansomHub can enumerate all accessible machines from the infected system.

Havoc features a module capable of host enumeration.

Gomir probes arbitrary network endpoints for TCP connectivity.

Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.

DUSTTRAP can use `ping` to identify remote hosts within the victim network.

BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.

Conti has the ability to discover hosts on a target network.

Diavol can use the ARP table to find remote hosts to scan.

BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.

DRATzarus can search for other machines connected to compromised host and attempt to map the network.

SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.

Flagpro has been used to execute net view on a targeted system.

SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.

Remsec can ping or traceroute a remote host.

Sykipot may use net view /domain to display hostnames of available systems on a network.

Epic uses the net view command on the victim’s machine.

USBferry can use net view to gather information about remote systems.

WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.

LODEINFO can run `net view` and `net view /domain` for network discovery.

The TAINTEDSCRIBE command and execution module can perform target system enumeration.

Shamoon scans the C-class subnet of the IPs on the victim's interfaces.

Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.

Bazar can enumerate remote systems using Net View.

RATANKBA runs the net view /domain and net view commands.

MgBot includes modules for performing ARP scans of local connected systems.

Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.

Carbon uses the net view command.

FunnyDream can collect information about hosts on the victim network.

Kwampirs collects a list of available servers with the command net view.

PoetRAT used Nmap for remote system discovery.

Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.

njRAT can identify remote hosts on connected networks.

Qilin can enumerate domain-connected hosts during its discovery phase.

Industroyer can enumerate remote computers in the compromised network.

QakBot can identify remote systems through the net view command.

Comnie runs the net view command

OSInfo performs a connection test to discover remote systems in the network

BitPaymer can use net view to discover remote systems.

HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`

Commands such as net view can be used in Net to gather information about available remote systems.

BloodHound can enumerate and collect the properties of domain computers, including domain controllers.

SILENTTRINITY can enumerate and collect the properties of domain computers.

Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.

ROADTools can enumerate Azure AD systems and devices.

Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc.

NBTscan can list NetBIOS computer names.