Procedure examples

Mustang Panda has used ipconfig and arp to determine network configuration information. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.

ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.

Scattered Spider has used network reconnaissance commands for discovery including `ping` and `nltest`.

Moses Staff has collected the domain name of a compromised network.

OilRig has run ipconfig /all on a victim.

Higaisa used ipconfig to gather network configuration information.

Tropic Trooper has used scripts to collect the host's network topology.

Ke3chang has performed local network configuration discovery using ipconfig.

APT1 used the ipconfig /all command to gather network configuration information.

Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.

Lotus Blossom has used commands such as `ipconfig` and `netstat` to gather network information on compromised hosts.

Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.

Chimera has used ipconfig, Ping, and tracert to enumerate the IP address and network environment and settings of the local host.

MirrorFace has used ipconfig for reconnaissance.

Medusa Group has obtained host network details utilizing the command `cmd.exe /c ipconfig /all`.

Darkhotel has collected the IP address and network adapter information from the victim’s machine.

APT42 has used malware, such as GHAMBAR and POWERPOST, to collect network information.

Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.

Earth Lusca used the command ipconfig to obtain information about network configurations.

Wizard Spider has used ipconfig to identify the network configuration of a victim machine. Wizard Spider has also used the PowerShell cmdlet `Get-ADComputer` to collect IP address data from Active Directory.

Moonstone Sleet has gathered information on victim network configuration.

Play has used the information-stealing tool Grixba to enumerate network information.

HEXANE has used Ping and `tracert` for network discovery.

Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.

Threat Group-3390 actors use NBTscan to discover vulnerable systems.

FIN13 has used `nslookup` and `ipconfig` for network reconnaissance efforts. FIN13 has also utilized a compromised Symantec Altiris console and LanDesk account to retrieve network information.

APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.

TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

cd00r can discover the IP for the network interface on the compromised device.

PowerDuke has a command to get the victim's domain and NetBIOS name.

EKANS can determine the domain of a compromised host.

BLINDINGCAN has collected the victim machine's local IP address information and MAC address.

Ninja can enumerate the IP address on compromised systems.

Pikabot gathers victim network information through commands such as ipconfig and ipconfig /all.

Amadey can identify the IP address of a victim machine.

Proxysvc collects the network adapter information and domain/username information based on current remote sessions.

Orz can gather victim proxy information.

Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.

NOKKI can gather information on the victim IP address.

yty runs ipconfig /all and collects the domain name.

Backdoor.Oldrea collects information about the Internet adapter configuration.

Stuxnet collects the IP address of a compromised system.

POWRUNER may collect network configuration data by running ipconfig /all on a victim.

KOPILUWAK can use Arp to discover a target's network configuration setttings.

Sardonic has the ability to execute the `ipconfig` command.

Emissary has the capability to execute the command ipconfig /all.

KEYMARBLE gathers the MAC address of the victim’s machine.

RedLeaves can obtain information about network parameters.

Felismus collects the victim LAN IP address and sends it to the C2 server.

GeminiDuke collects information on network settings and Internet proxy settings from the victim.