Procedure examples

Torisma can use `WTSEnumerateSessionsW` to monitor remote desktop connections.

POWRUNER may collect active network connections by running netstat -an on a victim.

KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.

Sardonic has the ability to execute the `netstat` command.

RedLeaves can enumerate drives and Remote Desktop sessions.

GravityRAT uses the netstat command to find open ports on the victim’s machine.

NETWIRE can capture session logon details from a compromised host.

PyDCrypt has used netsh to find RPC connections on remote machines.

Aria-body has the ability to gather TCP and UDP table status listings.

BADHATCH can execute `netstat.exe -f` on a compromised machine.

PUBLOAD has used several commands executed in sequence via `cmd` in a short interval to gather information on network connections.

Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.

Volgmer can gather information about TCP connection state.

Okrum was seen using NetSess to discover NetBIOS sessions.

Conti can enumerate routine network connections from a compromised host.

Lucifer can identify the IP and port numbers for all remote connections from the compromised host.

BlackEnergy has gathered information about local network connections using netstat.

SHOTPUT uses netstat to list TCP connection status.

Flagpro has been used to execute netstat -ano on a compromised host.

Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.

PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.

Remsec can obtain a list of active connections and open ports.

Sykipot may use netstat -ano to display active network connections.

Epic uses the net use, net session, and netstat commands to gather information on network connections.

Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.

USBferry can use netstat and nbtstat to detect active network connections.

Trojan.Karagany can use netstat to collect a list of network connections.

KONNI has used net session on the victim's machine.

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.

After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server.

RATANKBA uses netstat -ano to search for specific IP address ranges.

Zebrocy uses netstat -aon to gather network connection information.

SpeakUp uses the arp -a command.

Cobalt Strike can produce a sessions report from compromised hosts.

Carbon uses the netstat -r and netstat -an commands.

Ramsay can use netstat to enumerate network connections.

Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.

Egregor can enumerate all connected drives.

Maze has used the "WNetOpenEnumW", "WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine.

LunarWeb can enumerate system network connections.

QakBot can use netstat to enumerate current network connections.

jRAT can list network connections.

Waterbear can use API hooks on `GetExtendedTcpTable` to retrieve a table containing a list of TCP endpoints available to the application.

Comnie executes the netstat -ano command.

OSInfo enumerates the current network connections similar to net use .

Lizar has a plugin to retrieve information about all active network sessions on the infected server.

Dtrack can collect network and active connection information.

SLOTHFULMEDIA can enumerate open ports on a victim machine.

Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.

ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.