ipconfig is a Windows command that displays and manages basic network interface configuration. Attackers use it to enumerate IP addresses, gateways, DNS settings, and adapter state during reconnaissance. Defenders should treat its use as a normal administrative command unless it appears in suspicious chains with other discovery or exfiltration activity.
What ipconfig actually does on Windows
ipconfig is a built-in Windows utility for viewing and changing basic network interface settings. It reads the current configuration for each adapter, so you can see the machine’s IP address, default gateway, DNS servers, DHCP state, and whether an interface is up. In practice, it is a troubleshooting and discovery tool, not a security control.
Because it works against the local network stack, ipconfig is fast, low-friction, and available on most Windows systems without extra tooling. That makes it useful for administrators and equally useful for anyone trying to understand how a host is connected before moving on to other commands or network tests.
Why attackers and defenders both pay attention to it
ipconfig is commonly used during reconnaissance because it gives an operator a quick picture of local addressing and routing. The same output that helps a helpdesk engineer verify connectivity can help an adversary identify subnet boundaries, DNS infrastructure, or whether a host sits on a domain-joined or segmented network. Its value often comes from how ordinary it looks.
It is also a classic Living off the Land Guide example because it is a legitimate native utility that can appear inside wider discovery chains. When ipconfig is followed by commands such as whoami, net, nslookup, tasklist, or filesystem and share enumeration, the pattern matters more than the single command.
Defenders should treat ipconfig as normal administrative activity by default, then ask whether it is being used in a broader sequence that suggests discovery, staging, or exfiltration. The command itself is not suspicious; unusual timing, rare parent processes, repeated execution, or pairing with other enumeration tools is what turns it into a security signal.
How to interpret ipconfig output in a practical investigation
For troubleshooting, the key question is whether the values match the expected network design. A valid local IP, correct gateway, and expected DNS servers usually indicate healthy basic connectivity. For investigation, the same fields can reveal whether the host has switched networks, inherited unexpected DNS resolvers, or is operating on an interface that should not be active.
One useful habit is to compare what ipconfig shows with what the asset inventory or endpoint management platform says the host should have. If the adapter list, address ranges, or DNS servers do not line up with the known baseline, that gap is often more informative than the command output itself.
The command can also help explain later failures. If a host cannot resolve names, reach internal services, or contact update infrastructure, ipconfig often narrows the problem to DHCP, DNS, or adapter status before deeper packet analysis is needed. That makes it a first-step diagnostic, not a root-cause conclusion.
Risk and Threat Considerations
ipconfig creates low-level visibility into host networking, which is useful for troubleshooting but also useful for adversaries building a map of the environment. The risk is not that the command is dangerous by itself, but that it often discloses enough structure to guide follow-on enumeration or help an attacker decide where to probe next.
Failure mechanism: An attacker uses local network details, such as adapter state, gateway, and DNS information, to orient later discovery, identify internal services, or confirm that a host is connected to a more valuable network segment.
Impact: The command can support faster reconnaissance, better targeting, and more credible staging for lateral movement or data access when it appears as part of a broader abuse chain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1016 — System Network Configuration Discovery | ipconfig is used to discover local network configuration and adapter details. |
| Recommendation — Map ipconfig to discovery detections and correlate it with adjacent enumeration commands. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Command-line discovery is best detected through endpoint and audit logging. |
| Recommendation — Centralize endpoint command logging so ipconfig use can be reviewed in context. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Command execution visibility depends on reliable audit record generation for endpoints. |
| Recommendation — Enable command-line audit generation to capture ipconfig execution and surrounding activity. | ||
Practitioner Guidance
What to verify: Confirm whether ipconfig was run interactively by an administrator or as part of an unusual process tree. The command is most meaningful when you can correlate it with parent process, session context, and adjacent commands rather than treating the output alone as suspicious.
What to measure: Look for repetition, unusual execution frequency, and correlation with other discovery activity on endpoints that do not normally perform hands-on administration. A single execution is often noise; a cluster of enumeration commands in a short window is a more actionable signal.
Common mistake: Analysts sometimes over-focus on the command name and ignore the surrounding behavior. ipconfig is expected on Windows, so the real judgment is whether the host, timing, and command chain fit the user’s role and the system’s normal operational pattern.
Practitioner takeaway: Treat ipconfig as a context-bearing discovery primitive: on its own it is benign, but inside an unusual command sequence it can help establish attacker understanding of the local network and should be assessed with process, session, and neighbor-command evidence.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org