Procedure examples

Lizar has retrieved network information from a compromised host, such as the MAC address.

Dtrack can collect the host's IP addresses using the ipconfig command.

LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.

Azorult can collect host IP information from the victim’s machine.

UPPERCUT has the capability to gather the victim's proxy information.

FALLCHILL collects MAC address and local IP address information from the victim.

XORIndex Loader has leveraged webservices to identify the public IP of the victim host.

Small Sieve can obtain the IP address of a victim host.

ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.

Sliver has the ability to gather network configuration information.

evilginx2 can capture information from each session with a victim including the public IP used to access the server and the user agent.

ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.

Arp can be used to display ARP configuration information on the host.

Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.

ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.

PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.

PoshC2 can enumerate network adapter information.

AsyncRAT can enumerate the NetBIOS name on targeted machines.

Nltest may be used to enumerate the parent domain of a local machine using /parentdomain.

nbtstat can be used to discover local NetBIOS domain names.

NBTscan can be used to collect MAC addresses.

route can be used to discover routing configuration information.

CrackMapExec can collect DNS information from the targeted system.

Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.

Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.

QuasarRAT has the ability to enumerate the Wide Area Network (WAN) IP through requests to ip-api[.]com, freegeoip[.]net, or api[.]ipify[.]org observed with user-agent string `Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0`.

AdFind can extract subnet information from Active Directory.

TeamPCP Cloud Stealer has the ability to enumerate network interfaces.

Mini Shai-Hulud has discovered network configuration through the use of system commands to include `ip addr`, and `ip route`.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for source IP addresses.

BADFLICK has captured victim IP address details.

The reconnaissance modules used with Duqu can collect information on network configuration.