T1049Discovery
System Network Connections Discovery
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected.…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
9 Sigma rules tagged T1049System Network Connections DiscoveryT10499 general rules
- HackTool - SharpView Executionhightest
- Potential Pikabot Discovery Activityhightest
- Cisco Discoverylowtest
- Net.EXE Executionlowtest
- System Network Connections Discovery - Linuxlowtest
- System Network Connections Discovery Via Net.EXElowtest
- Use Get-NetTCPConnectionlowtest
- Use Get-NetTCPConnection - PowerShell Modulelowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to System Network Connections Discovery
1 CVE, by priority. Each link shows its badge.- CVE-2022-41328Fortinet FortiOS Path Traversal VulnerabilityFortinet · FortiOSKEVHigh · 7.1T1574Hijack Execution FlowT1037Boot or Logon Initialization Scripts+2 more · 1 reportMITRE CTID mapping of the KEV entry · follow-on activity10.7%Top 4.2%66.0priority