Procedure examples

Rising Sun can test a connection to a specified network IP address over a specified port number.

DarkTortilla can check for internet connectivity by issuing HTTP GET requests.

GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.

NKAbuse utilizes external services such as ifconfig.me to identify the victim machine's IP address.

More_eggs has used HTTP GET requests to check internet connectivity.

SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.

QakBot can measure the download speed on a targeted host.

Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.

Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.

PUBLOAD has collected information on Wi-Fi networks from victim hosts leveraging `netsh wlan show profiles`, `netsh wlan show interface`, and `netsh wlan show`.

CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.

Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.

TrickBot can enumerate computers and network devices.

MURKYTOP has the capability to identify remote hosts on connected networks.

yty uses the net view command for discovery.

Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.

RansomHub can enumerate all accessible machines from the infected system.

Havoc features a module capable of host enumeration.

Gomir probes arbitrary network endpoints for TCP connectivity.

Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.

DUSTTRAP can use `ping` to identify remote hosts within the victim network.

BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.

Conti has the ability to discover hosts on a target network.

Diavol can use the ARP table to find remote hosts to scan.

BlackCat can broadcasts NetBIOS Name Service (NBNC) messages to search for servers connected to compromised networks.

DRATzarus can search for other machines connected to compromised host and attempt to map the network.

SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.

Flagpro has been used to execute net view on a targeted system.

SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.

Remsec can ping or traceroute a remote host.

Sykipot may use net view /domain to display hostnames of available systems on a network.

Epic uses the net view command on the victim’s machine.

USBferry can use net view to gather information about remote systems.

WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.

LODEINFO can run `net view` and `net view /domain` for network discovery.

The TAINTEDSCRIBE command and execution module can perform target system enumeration.

Shamoon scans the C-class subnet of the IPs on the victim's interfaces.

Black Basta can use LDAP queries to connect to AD and iterate over connected workstations.

Bazar can enumerate remote systems using Net View.

RATANKBA runs the net view /domain and net view commands.

MgBot includes modules for performing ARP scans of local connected systems.

Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.

Carbon uses the net view command.

FunnyDream can collect information about hosts on the victim network.

Kwampirs collects a list of available servers with the command net view.

PoetRAT used Nmap for remote system discovery.

Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.

njRAT can identify remote hosts on connected networks.

Qilin can enumerate domain-connected hosts during its discovery phase.

Industroyer can enumerate remote computers in the compromised network.