T1018Discovery
Remote System Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, `esxcli network diag…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
17 Sigma rules tagged T1018Remote System DiscoveryT101817 general rules
- Chopper Webshell Process Patternhightest
- PUA - AdFind Suspicious Executionhightest
- Renamed AdFind Executionhightest
- Webshell Detection With Command Line Keywordshightest
- Webshell Hacking Activity Patternshightest
- HackTool - NetExec Executionhighexperimental
- DirectorySearcher Powershell Exploitationmediumtest
- Suspicious Scan Loop Networkmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Remote System Discovery
2 CVEs, by priority. Each link shows its badge.- CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.0T1595Active ScanningT1190Exploit Public-Facing Application+4 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.02%85.4priority
- CVE-2023-38035Ivanti Sentry Authentication Bypass VulnerabilityIvanti · SentryKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+6 moreMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.03%79.9priority