t1016-system-network-configuration-discovery

name	T1016_system-network-configuration-discovery
description	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1016","discovery","esxi","linux","macos","network-devices","windows"]
technique_id	T1016
tactic	discovery
all_tactics	["discovery"]
platforms	["ESXi","Linux","macOS","Network Devices","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1016
tech_stack	["esxi","linux","macos","network devices","windows"]
cwe_ids	["CWE-200"]
chains_with	["T1016.001","T1016.002"]
prerequisites	[]
severity_boost	{"T1016.001":"Chain with T1016.001 for deeper attack path","T1016.002":"Chain with T1016.002 for deeper attack path"}

T1016 System Network Configuration Discovery

High-Level Description

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.

Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface). On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command esxcli network nic list will retrieve the MAC address, while esxcli network ip interface ipv4 get will retrieve the local IPv4 address.

Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

Kill Chain Phase

• Discovery (TA0007)

Platforms: ESXi, Linux, macOS, Network Devices, Windows

What to Check

• Identify if System Network Configuration Discovery technique is applicable to target environment
• Check ESXi systems for indicators of System Network Configuration Discovery
• Check Linux systems for indicators of System Network Configuration Discovery
• Check macOS systems for indicators of System Network Configuration Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: System Network Configuration Discovery on Windows

Identify network configuration information

Upon successful execution, cmd.exe will spawn multiple commands to list network configuration settings. Output will be via stdout.

Supported Platforms: windows

ipconfig /all
netsh interface show interface
arp -a
nbtstat -n
net config