Procedure examples

STARWHALE has the ability to collect the IP address of an infected host.

Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.

Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.

Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.

POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.

ShadowPad has collected the domain name of the victim system.

Astaroth collects the external IP address from the system.

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

jRAT can gather victim internal and external IPs.

Denis uses ipconfig to gather the IP address from the system.

Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.

OSInfo discovers the current domain information.

Lizar has retrieved network information from a compromised host, such as the MAC address.

Dtrack can collect the host's IP addresses using the ipconfig command.

LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.

Azorult can collect host IP information from the victim’s machine.

UPPERCUT has the capability to gather the victim's proxy information.

FALLCHILL collects MAC address and local IP address information from the victim.

XORIndex Loader has leveraged webservices to identify the public IP of the victim host.

Small Sieve can obtain the IP address of a victim host.

ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.

Sliver has the ability to gather network configuration information.

evilginx2 can capture information from each session with a victim including the public IP used to access the server and the user agent.

ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.

Arp can be used to display ARP configuration information on the host.

Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.

ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.

PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.

PoshC2 can enumerate network adapter information.

AsyncRAT can enumerate the NetBIOS name on targeted machines.

Nltest may be used to enumerate the parent domain of a local machine using /parentdomain.

nbtstat can be used to discover local NetBIOS domain names.

NBTscan can be used to collect MAC addresses.

route can be used to discover routing configuration information.

CrackMapExec can collect DNS information from the targeted system.

Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.

Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.

QuasarRAT has the ability to enumerate the Wide Area Network (WAN) IP through requests to ip-api[.]com, freegeoip[.]net, or api[.]ipify[.]org observed with user-agent string `Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0`.

AdFind can extract subnet information from Active Directory.

TeamPCP Cloud Stealer has the ability to enumerate network interfaces.

Mini Shai-Hulud has discovered network configuration through the use of system commands to include `ip addr`, and `ip route`.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.

BADFLICK has captured victim IP address details.

The reconnaissance modules used with Duqu can collect information on network configuration.

QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS).

The Havoc demon can check for a connection to the C2 server from the target machine.

PUBLOAD has identified internet connectivity details through commands such as `tracert -h 5 -4 google.com` and `curl http://myip.ipip.net`.

Woody RAT can make `Ping` GET HTTP requests to its C2 server at regular intervals for network connectivity checks.

SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.

Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`.