Procedure examples

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.

GALLIUM used netstat -oan to obtain information about the victim network connections.

APT3 has a tool that can enumerate current network connections.

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download

Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.

menuPass has used net use to conduct connectivity checks to machines.

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.

TeamTNT has run netstat -anp to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify /etc/ld.so.preload.

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.

Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.

Mustang Panda has used netstat -ano to determine network connection information.

OilRig has used netstat -an on a victim to get a listing of network connections.

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.

Ke3chang performs local network connection discovery using netstat.

APT1 used the net use command to get a listing on network connections.

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

Poseidon Group obtains and saves information about victim network interfaces and addresses.

Lotus Blossom has used commands such as `netstat` to identify system network connections.

Chimera has used netstat -ano | findstr EST to discover network connections.

BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.

ToddyCat has used `netstat -anop tcp` to discover TCP connections to compromised hosts.

APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.

Lazarus Group has used net use to identify and establish a network connection with a remote host.

INC Ransom has used RDP to test network connections.

Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational”
(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.

Velvet Ant has enumerated existing network connections on victim devices.

HEXANE has used netstat to monitor connections to specific ports.

Magic Hound has used quser.exe to identify existing RDP connections.

Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.

FIN13 has used `netstat` and other net commands for network reconnaissance efforts.