T1049 System Network Connections Discovery: Detecting Connection and Session Enumeration

After landing on a host, attackers want to know what it talks to: which servers it holds sessions with, who is logged on, and which remote hosts are connected right now, because that list is a ready-made map for lateral movement. MITRE ATT&CK tracks this as T1049 System Network Connections Discovery, a Discovery (TA0007) technique with no sub-techniques, on ESXi, IaaS, Linux, macOS, Network Devices and Windows. This guide is for detection engineers, threat hunters and SOC leads. It explains what the technique looks like on each platform, the real groups that use it, the telemetry that catches it, and why ATT&CK gives it no preventive mitigation. For the wider family of discovery techniques, including T1046 Network Service Discovery, which probes listening services rather than reading existing connections, see the Discovery and Reconnaissance Techniques Guide.

Key takeaways

• It reads, it does not scan. T1049 lists connections and sessions that already exist, so it creates no network noise. Every useful signal is on the host, the device CLI or the cloud control plane.
• Prevention is not the play. ATT&CK v20 lists no mitigations for T1049 and states it cannot be easily mitigated with preventive controls, because it abuses normal system features.
• Context beats the single command. A netstat run by an administrator is noise; the same command spawned by a web server, an Office process or a service account in the first minutes after a new logon is a lead.
• Session enumeration has a remote form. net session and similar calls can be run against other servers, which shows up on the target as share and named pipe access, not only as a process on the source.
• Cloud and devices count too. In IaaS the same intent appears as describe and list API calls on VPCs, interfaces and peering; on routers it is show tcp brief style commands in command accounting.

What the technique is

ATT&CK v20 (technique version 2.5, last modified 12 May 2026) describes adversaries getting a listing of network connections to or from the compromised system, or from remote systems by querying over the network. The output tells the attacker which hosts are trusted peers, which file servers and databases this machine uses, which users hold sessions, and which security tools phone home. It is closely related to, but distinct from, several sibling discovery techniques.

Defenders should keep these separate in detection content (each has its own ATT&CK page and detection strategy) but correlate them in hunting, because attackers rarely run one in isolation. See the ATT&CK Discovery tactic page for the full list.

How adversaries use it: real cases

The v20 data lists dozens of groups and software families using T1049. A selection that shows the range, each from its ATT&CK procedure example:

• Volt Typhoon (G1017): used netstat -ano on compromised hosts to enumerate network connections, cited by ATT&CK to the June 2023 joint cybersecurity advisory and Secureworks research on BRONZE SILHOUETTE. This sits inside a wider living-off-the-land pattern where built-in tools replace malware.
• Turla (G0010): surveys a system on check-in with netstat -an, net use, net file and net session, per Kaspersky and ESET reporting cited by ATT&CK. This is the classic automated survey: the same block of commands on every new implant.
• Chimera (G0114): filtered netstat -ano output for established connections, per NCC Group reporting cited by ATT&CK.
• Magic Hound (G0059): used quser.exe to identify existing RDP connections, per The DFIR Report cited by ATT&CK. RDP session discovery tells the attacker where privileged users are logged on.
• TeamTNT (G0139): ran netstat -anp on Linux to look for rival malware connections, per Trend Micro reporting cited by ATT&CK, a cloud and container case.
• Earth Lusca (G1006): parsed the Microsoft-Windows-TerminalServices-RDPClient/Operational log (event ID 1024) to recover RDP connection history, per ATT&CK. This reads past connections from logs rather than live sockets, so command monitoring alone misses it.

The pattern across these cases: T1049 runs early, often scripted, usually alongside user, host and configuration discovery, and it feeds lateral movement such as T1021.001 Remote Desktop Protocol.

Session enumeration and netstat in detail

The two families of activity behave differently, so detection logic should treat them separately. The descriptions below are at the level needed to write rules, not to run the activity.

Local connection listing

netstat (ATT&CK software S0104), PowerShell Get-NetTCPConnection (in the NetTCPIP module, which returns local and remote address, port, state and owning process), ss and lsof on Linux and macOS all read the host's own socket table. They need no special rights for most output, leave no trace on the network, and are used constantly by administrators and monitoring agents. The signal is the parent process, the user, and what runs next.

Session and share enumeration

net use lists the host's own mapped connections. net session and net file (from ATT&CK software S0039, Net) list inbound SMB sessions and open files; run against a remote server they query it over SMB. That remote form matters: on the target server, the request appears as access to the IPC$ share, which Windows records in Security event 5145 when the Audit Detailed File Share subcategory is enabled. Microsoft documents that 5145 fires on every share object access, so it is high volume and must be filtered to IPC$ and to unexpected source addresses. On Linux, who -a and w give the equivalent logged-on session view.

Devices, hypervisors and cloud

On network devices ATT&CK names show ip sockets and show tcp brief through T1059.008 Network Device CLI; on ESXi, esxcli network ip connection list. In IaaS the attacker maps VPCs, subnets, interfaces and peering through the provider CLI or SDK, which overlaps with T1580 Cloud Infrastructure Discovery.

What to detect and where

ATT&CK detection strategy DET0320 (Detection of System Network Connections Discovery Across Platforms) defines one analytic per platform. The table maps each to log sources and practical tuning.

Behaviour sequences that work

• Discovery burst: three or more discovery binaries (for example netstat, whoami, ipconfig, net, quser, systeminfo) from the same parent within a few minutes. One command is noise; a burst is a survey.
• Unusual parent: connection listing spawned by w3wp.exe, sqlservr.exe, Java or Node application servers, Office applications or script hosts.
• Output to file: command line redirection of connection listings into temp or public folders, as in the admin@338 procedure example (netstat -ano appended to a file in %temp%).
• Remote session enumeration: event 5145 on servers showing IPC$ access from workstations that do not normally manage them, especially in a fan-out across many servers from one source.
• RDP log reads: processes other than Event Viewer or your log forwarder reading RDP client operational logs, the Earth Lusca pattern.
• Cloud mapping by a new principal: a role, access key or service principal with no history calling network describe APIs across many regions within an hour.

Where identity fits

Session discovery is identity discovery in disguise: net session and quser show which accounts are logged on where, which is how attackers find a server holding a privileged session worth stealing. Two non-human angles matter. First, service accounts and workload identities should almost never run interactive discovery commands, so discovery from a service account context is a high-fidelity signal; baseline them separately from human admins. See How to detect interactive logons by service accounts. Second, in cloud, AN0908 is entirely about machine credentials: describe calls from a CI role, an access key or a workload identity that has never mapped the network before suggest a stolen non-human credential. See the T1003 OS Credential Dumping guide for the step that usually follows finding a privileged session.

Mitigations and practical controls

ATT&CK v20 lists no mitigation objects for T1049. The controls below are NHI Mgmt Group recommendations that raise the cost or the visibility of the technique, not ATT&CK mitigations.

How to test your coverage

1. Confirm telemetry: check that command lines reach the SIEM for Windows, Linux and macOS, that 5145 is enabled on at least one domain controller and file server, and that CloudTrail or the Azure activity log is ingested.
2. Run a benign emulation: in a test host, have an authorised tester run a short discovery sequence from an unusual parent (for example a script launched by a test web application), using an established emulation framework mapped to T1049.
3. Check each analytic fires: the burst rule, the unusual parent rule and, from a second host, the remote session enumeration rule.
4. Measure noise for a week: count alerts per rule and list the top parents and users; add exclusions by signed path or named account, never by command name alone.
5. Repeat in cloud: call network describe APIs from a test role with no history and confirm the alert and its triage notes.
6. Roll back safely: if a rule floods the queue, move it to hunting-only rather than deleting it, and fix the baseline.

Metrics

• Percentage of endpoints and servers sending command line telemetry.
• Number of DET0320 platform analytics (out of six) implemented and tested.
• Median time from a discovery burst to analyst triage.
• False positive rate per rule after tuning.
• Service accounts with interactive logon rights (target: zero outside documented exceptions).

Common failure patterns

• Alerting on every netstat: the rule is muted within a week and real activity is lost with the noise.
• Excluding by process name: attackers simply rename binaries; exclude by signed path, hash or parent instead.
• Watching only the source host: remote net session enumeration is clearest on the target server, which is often not logging share access.
• No logs from ESXi and network devices: two platforms in the ATT&CK scope where many organisations have no command visibility at all.
• Ignoring API-based listing: PowerShell and custom tools read the same data without launching netstat.

Framework mapping

Practitioner checklist

• Collect command line telemetry from Windows, Linux and macOS, plus PowerShell script block logging.
• Enable Audit Detailed File Share on domain controllers and file servers, filtered to IPC$.
• Build a discovery burst rule rather than single command alerts.
• Flag connection listing from web, database and Office parent processes.
• Baseline service accounts separately and alert on any discovery from them.
• Ingest ESXi command logs and network device command accounting.
• Alert on network describe API bursts from new or rarely used cloud principals.
• Test each DET0320 analytic with an authorised emulation and track noise.

Standards and references

• MITRE ATT&CK: System Network Connections Discovery (T1049)
• MITRE ATT&CK: Discovery (TA0007)
• MITRE ATT&CK: netstat (S0104)
• MITRE ATT&CK: Volt Typhoon (G1017)
• Microsoft: Sysmon
• Microsoft: Event 5145, network share object access check
• Microsoft: Get-NetTCPConnection
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Discovery and Reconnaissance Techniques Guide · ESXi Logs Detection Guide · AWS CloudTrail Guide · T1003 OS Credential Dumping · ATT&CK Detection Strategies and Analytics