T1016 System Network Configuration Discovery: Detecting Network Mapping on Hosts and Devices

Almost every intrusion pauses on its first host to ask the same questions: what is my IP address, which subnet am I on, where is the gateway, which DNS servers and domain do I belong to, and can I reach the internet. MITRE ATT&CK tracks this as T1016 System Network Configuration Discovery, a Discovery (TA0007) technique on ESXi, Linux, macOS, Network Devices and Windows, with two sub-techniques: T1016.001 Internet Connection Discovery and T1016.002 Wi-Fi Discovery. The commands involved are the same ones administrators run all day, so the defender's job is not to block them but to recognise when they appear in the wrong context, in the wrong order or from the wrong identity. This guide covers how adversaries use the technique, the telemetry and detection logic that work in practice, the controls that limit what the answers reveal, and how to test your coverage. It is written for detection engineers, SOC analysts and threat hunters. Discovery usually precedes lateral movement; see the Lateral Movement Guide for what follows.

Key takeaways

• Context is the signal, not the command. ipconfig or ip a on its own is noise; the same command spawned by a web server, an Office process, a service account or a fresh remote session is worth an alert.
• Look for bursts. ATT&CK's detection strategy DET0195 asks you to cluster enumeration commands within short time windows; a chain of network, user and system queries within a minute is the pattern of a hands-on or scripted intruder.
• Network devices and hypervisors are in scope. show ip route on a router and esxcli network on an ESXi host are the same technique, and they are invisible unless you collect device command accounting and ESXi hostd logs.
• Wi-Fi discovery is credential theft in disguise. T1016.002 includes reading saved Wi-Fi profiles with keys in clear text, which turns a laptop compromise into network access.
• There is no ATT&CK mitigation to deploy. ATT&CK v20 maps no mitigations to T1016; your levers are telemetry, least functionality on servers and appliances, and segmentation that makes the answers less useful.

What the technique is

ATT&CK v20 (technique version 1.7) describes adversaries looking for details about the network configuration and settings, such as IP and MAC addresses, of the systems they access. It names built-in utilities as the usual means: Arp (S0099), ipconfig (S0100) and ifconfig (S0101), nbtstat (S0102) and route (S0103). On network devices the same information comes from the T1059.008 Network Device CLI through commands such as show ip route and show ip interface. On ESXi, ATT&CK gives esxcli network nic list (MAC addresses) and esxcli network ip interface ipv4 get (local IPv4 address) as examples.

The answers shape what the adversary does next: which subnets to scan, whether the host is domain-joined, whether there is a proxy, and whether command and control traffic can leave directly. Closely related techniques have their own pages: T1049 System Network Connections Discovery covers active connections (netstat-style output), T1018 Remote System Discovery covers listing other hosts, and cloud network inventory through provider APIs is T1580 Cloud Infrastructure Discovery.

How adversaries use it: real cases

ATT&CK v20 lists hundreds of procedure examples for T1016, which tells you how routine the technique is. A few show the range of contexts you need to cover.

• Living off the land on Windows: ATT&CK records that Volt Typhoon (G1017) executed ipconfig, netsh interface firewall show all and netsh interface portproxy show all to enumerate network topology and settings, citing the June 2023 joint cybersecurity advisory. Microsoft's May 2023 report on the same actor stresses that activity using normal sign-in channels and system binaries can only be found through behavioural monitoring. See the Volt Typhoon Threat Actor Profile.
• Ransomware on hypervisors: Trellix's 2024 analysis of the RansomHouse tool MrAgent shows it building a host identifier from the hostname and the MAC address returned by esxcli network nic list, reading the IPv4 address with esxcli network ip interface ipv4 get, and later disabling the ESXi firewall. The network details let operators track and reach each hypervisor before encryption.
• Network devices: ATT&CK records the RedPenguin campaign (C0056), in which UNC3886 used Junos OS CLI queries to obtain interface details, and Salt Typhoon (G1045) discovering and modifying the network configurations of victim devices, citing CISA advisory AA25-239A.
• Agent-driven intrusions: ATT&CK v20 records that in the AI-orchestrated campaign it tracks as C0062 the adversary configured Claude Code to identify and gather system configurations of discovered devices. Our Anthropic GTG-1002 Campaign 2025 page describes agents mapping infrastructure and services in parallel, at machine speed, which compresses the discovery phase from hours into minutes and makes burst detection more important, not less.
• Ransomware affiliates: ATT&CK records Medusa Group (G1051) running cmd.exe /c ipconfig /all and Scattered Spider (G1015) using ping and nltest for network reconnaissance. See the Scattered Spider Threat Actor Profile.

What to detect and where

DET0195 contains one analytic per platform. The table restates each analytic with its log source and the tuning fields ATT&CK marks as environment specific.

Three practical points make these analytics work:

• Collect the command line: Sysmon Event ID 1 records the full command line of the process and its parent, and a ProcessGUID that stays stable when Windows reuses process IDs. Without command lines, netsh used for Wi-Fi key retrieval and netsh used for diagnostics look identical. See the Sysmon Guide.
• Turn on script block logging: PowerShell and WMI queries such as reading adapter configuration through CIM classes never start ipconfig.exe. Script block logging writes Event ID 4104; Microsoft notes logged content can contain secrets and recommends Protected Event Logging.
• Bring device and hypervisor logs in: network device command accounting and ESXi hostd logs are usually the gaps. See the Network Device Syslog and Configuration Change Detection Guide, the ESXi Logs Detection Guide and, for Linux, the Linux Logging and auditd for Defenders Guide.

Detection logic that holds up

The rules below are NHI Mgmt Group recommendations built on the DET0195 analytics. Each is described as logic, so you can express it in your own query language.

Treat the output of these rules as a trigger for correlation rather than an incident: check what the same session did in the next 30 minutes (credential access, remote service use, new outbound connections). The T1087 and T1069 Account and Permission Group Discovery Defensive Guide covers the identity queries that usually sit in the same burst.

Where identity fits

Network configuration discovery is a host technique, but the account that runs it is often the best signal. Two non-human cases matter. First, service accounts and workload identities: a web application pool identity, a database service account or a CI runner suddenly spawning ipconfig, route print or ip route is almost always exploitation, because those identities run fixed code. Second, automation and AI agents: agents with shell tools legitimately run diagnostic commands, so give each agent its own identity, log its tool calls and baseline what it normally runs. The ATLAS counterpart for agent-side environment mapping is AML.T0089 Enterprise Environment Discovery.

Reducing what discovery reveals

ATT&CK v20 maps no mitigations to T1016 or its sub-techniques, because the information is needed for normal operation. The controls below are NHI Mgmt Group recommendations that reduce the value of the answers or make the activity easier to see.

How to test your coverage

1. Confirm telemetry first: on one Windows, Linux and macOS test host, verify process creation with command lines, PowerShell 4104 and auditd execve events reach the SIEM, and that one ESXi host and one router send hostd and command accounting logs.
2. Run benign emulation: in an authorised test, run the built-in utilities named in DET0195 from three contexts: an admin shell, a scheduled task under a service account, and a child of an Office or web server process. Open-source emulation libraries map tests to T1016; use them only on lab or approved hosts.
3. Check each rule fires once, with context: the alert should name the parent, the user and the other commands in the burst.
4. Baseline for two weeks in alert-only mode: record which scripts, agents and teams trigger each rule, and exclude by signed path and hash, not by command name.
5. Promote and roll back safely: raise severity only for the low-noise rules first (suspicious parent, service account shell, Wi-Fi key retrieval); if alert volume spikes, revert the rule to alert-only rather than deleting it.
6. Repeat after change: rerun the tests after EDR, Sysmon configuration or logging pipeline changes.

Measuring whether it works

• Percentage of servers and workstations sending process creation with full command lines (target: all in scope).
• Percentage of ESXi hosts and network devices sending hostd or command accounting logs to the SIEM.
• Number of excluded parent and path combinations per rule, reviewed quarterly (rising exclusions erode coverage).
• True positive rate of the discovery burst rule after tuning.
• Time from a discovery alert to an analyst checking the follow-on activity of the same session.

Common failure patterns

• Alerting on every ipconfig: the rule drowns the SOC within a day and is switched off. Alert on context and sequence instead.
• Process names only: without command lines and script block logs, PowerShell and WMI based discovery and netsh key retrieval go unseen.
• Ignoring the infrastructure planes: traditional host EDR agents generally cannot be installed on ESXi or network devices (check your vendor's support), and procedure examples from RansomHouse, Salt Typhoon and UNC3886 sit exactly there.
• Excluding by command name: an exclusion for "ipconfig from monitoring tools" written on the binary name also hides the attacker.
• Treating an alert as closed when nothing else happened: discovery is a precursor; a quiet session today may return tomorrow with valid credentials.

Framework mapping

Practitioner checklist

• Collect process creation with full command lines and parent details on Windows, Linux and macOS.
• Enable PowerShell script block logging and protect the logs.
• Send ESXi hostd logs and network device command accounting to the SIEM.
• Build the suspicious parent, service account shell and Wi-Fi key retrieval rules first.
• Add a discovery burst rule that correlates network, user and system queries within a short window.
• Baseline in alert-only mode and exclude by signed path and hash, not by command name.
• Force server egress through a proxy and alert on direct internet connectivity checks.
• Run authorised emulation tests after every telemetry change.

Standards and references

• MITRE ATT&CK: System Network Configuration Discovery (T1016)
• MITRE ATT&CK: Internet Connection Discovery (T1016.001)
• MITRE ATT&CK: Wi-Fi Discovery (T1016.002)
• Microsoft: Sysmon
• Microsoft: about_Logging_Windows (PowerShell)
• Microsoft: Volt Typhoon targets US critical infrastructure with living-off-the-land techniques
• Trellix: RansomHouse am see
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Lateral Movement Guide · T1580 and T1619 Cloud Infrastructure and Storage Discovery Guide · T1087 and T1069 Account and Permission Group Discovery Defensive Guide · Sysmon Guide