t1018-remote-system-discovery

name	T1018_remote-system-discovery
description	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1018","discovery","esxi","linux","macos","network-devices","windows"]
technique_id	T1018
tactic	discovery
all_tactics	["discovery"]
platforms	["ESXi","Linux","macOS","Network Devices","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1018
tech_stack	["esxi","linux","macos","network devices","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1018 Remote System Discovery

High-Level Description

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, esxcli network diag ping.

Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment.

Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).

Kill Chain Phase

• Discovery (TA0007)

Platforms: ESXi, Linux, macOS, Network Devices, Windows

What to Check

• Identify if Remote System Discovery technique is applicable to target environment
• Check ESXi systems for indicators of Remote System Discovery
• Check Linux systems for indicators of Remote System Discovery
• Check macOS systems for indicators of Remote System Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Remote System Discovery - net

Identify remote systems with net.exe.

Upon successful execution, cmd.exe will execute net.exe view and display results of local systems on the network that have file and print sharing enabled.

Supported Platforms: windows

net view /domain
net view

Atomic Test 2: Remote System Discovery - net group Domain Computers

Identify remote systems with net.exe querying the Active Directory Domain Computers group.