Before an intruder can move laterally, it needs a target list: which hosts exist, which are domain controllers, file servers, hypervisors or management consoles, and which ones it can reach from where it stands. MITRE ATT&CK tracks the building of that list as T1018 Remote System Discovery, a Discovery (TA0007) technique on ESXi, Linux, macOS, Network Devices and Windows. It ranges from a quiet LDAP query for every computer object in Active Directory to a noisy ping sweep, a read of the local hosts file or ARP cache, or show cdp neighbors on a switch. This guide explains how adversaries use it, what to detect in host, directory and network telemetry, which controls make the target list shorter, and how to test that your detections fire. It is written for detection engineers, SOC analysts, Active Directory and infrastructure teams.
Key takeaways
- It is the last step before lateral movement. A confirmed T1018 alert means the intruder already has a foothold and is choosing its next host; respond with that urgency.
- Directory queries beat ping sweeps. Mature actors list computers from Active Directory over LDAP, which generates no scanning traffic; domain controller telemetry is where you see it.
- Passive sources leave almost no trace. Reading
/etc/hosts, the Windows hosts file, the ARP cache or SSHknown_hostsneeds no network activity, so host process and file telemetry are the only signals. - Infrastructure is a prime target list. ATT&CK and CISA record actors looking specifically for VMware vCenter, and using network device commands and SNMP to enumerate devices.
- Prevention is about reachability and identity. ATT&CK states the technique cannot be easily mitigated with preventive controls; segmentation, tight directory read rights where possible and scoped service accounts limit what the list is worth.
What the technique covers
ATT&CK v20 (technique version 3.6, no sub-techniques) describes adversaries getting a listing of other systems by IP address, hostname or other logical identifier, to use for lateral movement. It names built-in utilities such as Ping (S0097) and net view through Net (S0039), esxcli network diag ping on ESXi, passive sources such as the local hosts file and ARP cache entries, and network device CLI commands such as show cdp neighbors and show arp through T1059.008 Network Device CLI.
| Method | Examples from ATT&CK procedure data | Network footprint | Where you see it |
|---|---|---|---|
| Directory query | Sandworm Team querying Active Directory over LDAP for computer objects; APT29 using AdFind during the SolarWinds compromise; FIN8 using nltest /dclist to list domain controllers | LDAP or RPC to a domain controller only | Domain controller and identity threat detection telemetry; process creation on the source host |
| Active sweep | Volt Typhoon using Ping and other methods; Akira using Advanced IP Scanner and MASSCAN; Silence using Nmap | ICMP, ARP or TCP probes to many addresses | Flow logs, internal IDS, Sysmon network events, EDR |
| Passive local source | Rocke reading SSH known_hosts for addresses; ShinyHunters reading /etc/hosts to find the internal subnet | None | Process and file access telemetry only |
| Infrastructure enumeration | Scattered Spider looking for VMware vCenter; Salt Typhoon using SNMPwalk to enumerate devices | Management protocols (HTTPS, SNMP) | vCenter and device logs, SNMP agent logs, network monitoring |
| Inventory tools | Medusa Group using PDQ Inventory to list endpoints | Looks like normal IT management | Tool execution by unexpected users or on unexpected hosts |
Neighbouring techniques have their own pages: T1016 System Network Configuration Discovery covers the local host's own settings, T1046 Network Service Discovery covers port and service scanning, and listing cloud instances through provider APIs with stolen keys is T1580 Cloud Infrastructure Discovery.
Real cases
- Scattered Spider and vCenter: CISA advisory AA23-320A records that after establishing persistence the actors searched for VMware vCenter infrastructure (mapped to T1018), enumerated Active Directory, and in the cloud activated AWS Systems Manager Inventory to find lateral movement targets before moving to EC2 instances. The advisory notes the actors encrypted ESXi servers. The lesson is that infrastructure consoles are the targets that matter most. See the Scattered Spider Threat Actor Profile.
- Volt Typhoon: Microsoft's May 2023 report describes remote system discovery using PowerShell, WMIC and
ping, and states that activity using normal channels and system binaries can only be found with behavioural monitoring. See the Volt Typhoon Threat Actor Profile. - Industrial targets: ATT&CK records that in the 2016 Ukraine Electric Power Attack (C0025) Sandworm Team checked connectivity to network resources and used LDAP to query Active Directory for computer information, and that in the 2015 attack (C0028) OT systems were visible from the IT network.
- Agent-driven discovery: ATT&CK v20 records that in the AI-assisted breach of Mexican government infrastructure (C0064) the adversary used Claude Code to drive remote system discovery. Machine-speed discovery shortens the gap between first host and lateral movement, which makes directory-side and burst detections more valuable. The Anthropic GTG-1002 Campaign 2025 page describes a comparable pattern of agents mapping infrastructure in parallel.
What to detect and where
ATT&CK detection strategy DET0574 (Detection Strategy for Remote System Enumeration Behavior) defines one analytic per platform:
| Platform (analytic) | Behaviour | Log source in ATT&CK | Tune for |
|---|---|---|---|
| Windows (AN1583) | net.exe, ping.exe, tracert.exe and similar run in short succession, often chained with lateral movement tools | Sysmon Event ID 1 (process creation); Event IDs 3 and 22 (network connection, DNS query) | Bursts within about 30 seconds, approved IT tooling, odd parents such as Word spawning net.exe |
| Linux (AN1584) | Scripts or shells issuing sequential ping, arp or traceroute | auditd execve; syslog network records | Sensitive target ranges, interactive versus cron |
| macOS (AN1585) | arp, netstat, ping and reads of /etc/hosts | Unified log process events; osquery file events | Suspicious users or automation contexts, IT tooling |
| ESXi (AN1586) | esxcli network diag ping or routing table views over the ESXi shell or SSH | ESXi hostd log | Unauthorised shell use, root over SSH |
| Network devices (AN1587) | show cdp neighbors, show arp and similar on Cisco or Juniper devices | Device syslog (for example facility LOCAL7) or traps | Make and model specific command list, privilege escalation before the commands |
Sysmon network connection logging (Event ID 3) is disabled by default, so enable it with a filter before you rely on it; see the Sysmon Guide.
Directory-side detection
Because directory queries generate no sweep traffic, add domain controller telemetry. Microsoft Defender for Identity, as one example, documents classic alerts that map to this behaviour:
- Network-mapping reconnaissance (DNS), external ID 2007: mapped by Microsoft to T1018, T1046 and T1087; fires on DNS zone transfer (AXFR) requests from non-DNS servers or an excessive number of requests. Microsoft's prevention advice is to disable zone transfers or restrict them to specific IP addresses.
- User and Group membership reconnaissance (SAMR), external ID 2021: SAM-R enumeration from computers that do not normally make such queries; restrict SAM remote calls with the Network access group policy.
- Honeytoken was queried via LDAP, external ID 2429: any LDAP query against a decoy account. The same idea works for decoy computer objects; see the Honeytokens and Canary Credentials Guide.
Whatever product you use, the logic is the same: a workstation or application server that suddenly asks a domain controller for every computer object, or for all domain controllers, is behaving like a tool, not a user.
Detection rules to build
The rules below are NHI Mgmt Group recommendations built on DET0574.
| Rule | Logic | Expected noise |
|---|---|---|
| Internal fan-out | One source contacts more than a set number of distinct internal addresses (ICMP or TCP SYN) in a few minutes, where it has no history of doing so | Medium: vulnerability scanners and monitoring; exclude by source address and owner |
| Bulk directory read from an unusual client | LDAP searches returning all computer objects, or DC listing, from a host that is not a management server | Medium until management servers and identity tools are baselined |
| Discovery utility chain | net, nltest, ping, arp, AdFind-style tools or scanning executables from one session within a short window | Low to medium |
| Scanner on a non-IT host | Execution of network scanning or inventory tools on a host or by an account outside the IT and security teams | Low |
| Infrastructure CLI enumeration | Neighbour, ARP or SNMP walk activity from an account or source outside the network team | Low |
| Passive source read | Non-admin processes reading known_hosts files across users, or hosts files, followed by outbound SSH or SMB | Low when the follow-on condition is required |
For the identity side of the same burst (user and group queries), see the T1087 and T1069 Account and Permission Group Discovery Defensive Guide; for AD attack path tools that combine host and identity discovery, see the BloodHound and Active Directory Attack Path Guide.
Where identity fits
Every directory query runs as an identity, and many of the noisiest are non-human. Inventory, backup, monitoring and patching tools use service accounts that legitimately enumerate every computer. Two consequences follow. First, a stolen inventory service account lets an attacker enumerate quietly and look like the tool, so watch for that account authenticating from a new host or at a new time. Second, discovery from an application service account (a web pool identity, a SQL Server service account) is a high-fidelity signal, because those accounts have no reason to list computers. In cloud estates the equivalent is a CI/CD key or workload role calling instance listing APIs it never called before; see How to Detect aws access key use from unusual locations.
Reducing what discovery yields
ATT&CK v20 maps no mitigations to T1018 and states that it cannot be easily mitigated with preventive controls because it abuses system features. These controls are NHI Mgmt Group recommendations.
| Control | What it changes | Trade-off |
|---|---|---|
| Segmentation and host firewalls | A sweep from a workstation reaches only its own segment; management interfaces answer only admin networks | Needs an accurate flow map; see the Network Segmentation Guide |
| Isolate management planes | vCenter, ESXi, backup consoles and device management are unreachable from user and server networks | Admins need a jump host or privileged access workstation |
| Restrict DNS zone transfers and SAM-R | Removes two bulk enumeration paths | Low; check legacy tools first |
| Scope service accounts | Inventory accounts can log on only from their tool servers | Requires an owner and a review per account |
| Deception | Decoy computer objects and hosts turn any enumeration into an alert | Needs upkeep; see the Deception Technology Guide |
| SNMPv3 and limited SNMP access lists | Stops SNMP walks with guessed community strings | Device configuration work |
How to test and roll out
- Confirm telemetry: process creation with command lines on endpoints, Sysmon Event ID 3 enabled on a pilot group, domain controller sensors or LDAP logging, flow logs on internal segments, and ESXi and device logs reaching the SIEM.
- Emulate in an authorised test: from a pilot workstation, run directory-based discovery, a small ping sweep of a test subnet and a hosts file read, using an open emulation library mapped to T1018.
- Verify each signal: each test should produce an alert or at least a searchable event that names the host, account and method.
- Baseline in alert-only mode for two to four weeks: list every legitimate scanner, inventory tool and service account; exclude by source and identity, never by tool name alone.
- Promote by fidelity: turn on paging for scanners on non-IT hosts and discovery by application service accounts first; keep fan-out rules as hunting leads until tuned. If volume spikes, return the rule to alert-only rather than removing it.
Measuring progress
- Percentage of domain controllers covered by LDAP and SAM-R monitoring.
- Percentage of internal segments with flow logging.
- Number of service accounts allowed to enumerate computers, each with an owner and logon restriction.
- Number of user or server subnets that can reach vCenter, ESXi or device management (target: none outside admin networks).
- Time from a T1018 alert to containment of the source host.
Common failure patterns
- Watching only for scans: directory queries and passive sources produce no sweep traffic and are missed.
- Blanket scanner exclusions: excluding a scanning tool by name everywhere lets an attacker run the same tool from any host.
- Management consoles on flat networks: once vCenter is on the target list and reachable, hypervisor-wide encryption follows, as CISA describes for Scattered Spider.
- Unscoped inventory service accounts: a stolen inventory credential gives an approved, quiet way to list every host.
- Closing the alert as reconnaissance only: remote system discovery means an attacker is already inside; scope the source host and identity.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1018; tactic TA0007; DET0574 | Technique and detection strategy |
| NIST SP 800-53 Rev 5 | SI-4 System Monitoring; AU-6 Audit Record Review, Analysis, and Reporting | Host, directory and network monitoring |
| NIST SP 800-53 Rev 5 | SC-7 Boundary Protection; AC-6 Least Privilege; AC-2 Account Management | Segmentation and scoped service accounts |
| NIST CSF 2.0 | DE.CM-01; DE.AE-02; PR.AA-05 | Network monitoring, analysis, least privilege |
| ISO/IEC 27001:2022 Annex A | A.8.16 Monitoring activities; A.8.22 Segregation of networks | Monitoring and segmentation |
Practitioner checklist
- Collect process creation with command lines and enable Sysmon network events on a pilot group.
- Monitor domain controllers for bulk LDAP reads, SAM-R enumeration and zone transfer attempts.
- Restrict DNS zone transfers and SAM remote calls.
- Turn on internal flow logging and build a fan-out rule.
- Alert on scanners and inventory tools run outside IT and security hosts.
- Isolate vCenter, ESXi, backup and device management from user and server networks.
- Give every inventory service account an owner and logon restrictions.
- Seed decoy computer objects and test the alert path quarterly.
Standards and references
- MITRE ATT&CK: Remote System Discovery (T1018)
- CISA: Scattered Spider advisory (AA23-320A)
- Microsoft: Defender for Identity classic security alerts
- Microsoft: Sysmon
- Microsoft: Volt Typhoon targets US critical infrastructure with living-off-the-land techniques
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Lateral Movement Guide · BloodHound and Active Directory Attack Path Guide · T1580 and T1619 Cloud Infrastructure and Storage Discovery Guide · T1021 Remote Services