Procedure examples

Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.

Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.

QuasarRAT has the ability to enumerate the Wide Area Network (WAN) IP through requests to ip-api[.]com, freegeoip[.]net, or api[.]ipify[.]org observed with user-agent string `Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0`.

AdFind can extract subnet information from Active Directory.

TeamPCP Cloud Stealer has the ability to enumerate network interfaces.

Mini Shai-Hulud has discovered network configuration through the use of system commands to include `ip addr`, and `ip route`.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.

ShinyHunters has collected machine names and IP addresses by parsing the process scheduler configuration file psappsrv.cfg.

BADFLICK has captured victim IP address details.

The reconnaissance modules used with Duqu can collect information on network configuration.

During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.

During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.

Volt Typhoon has employed Ping to check network connectivity.

HAFNIUM has checked for network connectivity from a compromised host using `ping`, including attempts to contact `google[.]com`.

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`. Gamaredon Group has searched the ping records to obtain the C2 address and has used ping to search for the C2’s status.

TA2541 has run scripts to check internet connectivity from compromised hosts.

Turla has used tracert to check internet connectivity.

Lotus Blossom has performed checks to determine if a victim machine is able to access the Internet.

APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.

HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.

Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.

FIN13 has used `Ping` and `tracert` for network reconnaissance efforts.

QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS).

The Havoc demon can check for a connection to the C2 server from the target machine.

PUBLOAD has identified internet connectivity details through commands such as `tracert -h 5 -4 google.com` and `curl http://myip.ipip.net`.

Woody RAT can make `Ping` GET HTTP requests to its C2 server at regular intervals for network connectivity checks.

SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.

Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`.

Rising Sun can test a connection to a specified network IP address over a specified port number.

DarkTortilla can check for internet connectivity by issuing HTTP GET requests.

GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.

NKAbuse utilizes external services such as ifconfig.me to identify the victim machine's IP address.

More_eggs has used HTTP GET requests to check internet connectivity.

SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.

QakBot can measure the download speed on a targeted host.

During APT28 Nearest Neighbor Campaign, APT28 collected information on wireless interfaces within range of a compromised system.

Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.

Emotet can extract names of all locally reachable Wi-Fi networks and then perform a brute-force attack to spread to new networks.

Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.

PUBLOAD has collected information on Wi-Fi networks from victim hosts leveraging `netsh wlan show profiles`, `netsh wlan show interface`, and `netsh wlan show`.

CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.

Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.

During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.

During Operation Digital Eye, threat actors used Ping for reconnaissance.

During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.

During the SolarWinds Compromise, APT29 used AdFind to enumerate remote systems.

During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.

During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.

During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.