This site has been deprecated in favor of and will remain in place until 11/1/22.

Network Connection Enumeration

From attackics
Jump to navigation Jump to search

To visit this technique’s new page please go to and update your links to

Network Connection Enumeration
ID T0840
Tactic Discovery
Data Sources Command: Command Execution, Process: OS API Execution, Process: Process Creation
Asset Human-Machine Interface


Adversaries may perform network connection enumeration to discover information about device communication patterns. If an adversary can inspect the state of a network connection with tools, such as netstat, in conjunction with System Firmware, then they can determine the role of certain devices on the network 1. The adversary can also use Network Sniffing to watch network traffic for details about the source, destination, protocol, and content.

Procedure Examples

  • EKANS performs a DNS lookup of an internal domain name associated with its target network to identify if it was deployed on the intended system.2
  • Industroyer contains an IEC 61850 module that enumerates all connected network adapters to determine their TCP/IP subnet masks.3