系统网络连接发现

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download^[1]

Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.^[2]

APT1 used the net use command to get a listing on network connections.^[3]

APT3 has a tool that can enumerate current network connections.^[4][5][6]

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.^[7]

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.^[8]

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.^[9][10]

APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.^[11]

Aria-body has the ability to gather TCP and UDP table status listings.^[12]

Babuk can use "WNetOpenEnumW" and "WNetEnumResourceW" to enumerate files in network resources for encryption.^[13]

BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.^[14]

BADHATCH can execute netstat.exe -f on a compromised machine.^[15]

BlackEnergy has gathered information about local network connections using netstat.^[16][17]

Carbon uses the netstat -r and netstat -an commands.^[18]

CharmPower can use netsh wlan show profiles to list specific Wi-Fi profile details.^[19]

Chimera has used netstat -ano | findstr EST to discover network connections.^[20]

Cobalt Strike can produce a sessions report from compromised hosts.^[21]

Comnie executes the netstat -ano command.^[22]

Conti can enumerate routine network connections from a compromised host.^[23]

CrackMapExec can discover active sessions for a targeted system.^[24]

Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.^[25]

Dtrack can collect network and active connection information.^[26]

The discovery modules used with Duqu can collect information on network connections.^[27]

Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log "Microsoft-Windows-TerminalServices-RDPClient/Operational"(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.^[28]

Egregor can enumerate all connected drives.^[29]

Empire can enumerate the current network connections of a host.^[30]

Epic uses the net use, net session, and netstat commands to gather information on network connections.^[31][32]

FIN13 has used netstat and other net commands for network reconnaissance efforts.^[33]

Flagpro has been used to execute netstat -ano on a compromised host.^[34]

FRP can use a dashboard and U/I to display the status of connections from the FRP client and server.^[35]

During FunnyDream, the threat actors used netstat to discover network connections on remote systems.^[36]

GALLIUM used netstat -oan to obtain information about the victim network connections.^[37]

GravityRAT uses the netstat command to find open ports on the victim’s machine.^[38]

HEXANE has used netstat to monitor connections to specific ports.^[39]

INC Ransom has used RDP to test network connections.^[40]

jRAT can list network connections.^[41]

Ke3chang performs local network connection discovery using netstat.^[42][43]

KONNI has used net session on the victim's machine.^[44]

KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.^[45]

Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.^[46]

Lazarus Group has used net use to identify and establish a network connection with a remote host.^[47]

Lizar has a plugin to retrieve information about all active network sessions on the infected server.^[48]

Lucifer can identify the IP and port numbers for all remote connections from the compromised host.^[49]

LunarWeb can enumerate system network connections.^[50]

Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.^[51]

Mafalda can use the GetExtendedTcpTable function to retrieve information about established TCP connections.^[52]

Magic Hound has used quser.exe to identify existing RDP connections.^[53]

Maze has used the "WNetOpenEnumW", "WNetEnumResourceW", "WNetCloseEnum" and "WNetAddConnection2W" functions to enumerate the network resources on the infected machine.^[54]

menuPass has used net use to conduct connectivity checks to machines.^[55]

After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server. ^[56]

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.^[57]

Mustang Panda has used netstat -ano to determine network connection information.^[58]

nbtstat can be used to discover current NetBIOS sessions.

Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.^[59]

netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.^[60]

NETWIRE can capture session logon details from a compromised host.^[61]

OilRig has used netstat -an on a victim to get a listing of network connections.^[62]

Okrum was seen using NetSess to discover NetBIOS sessions.^[63]

During Operation CuckooBees, the threat actors used the net session, net use, and netstat commands as part of their advanced reconnaissance.^[64]

During Operation Wocao, threat actors collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.^[65]

OSInfo enumerates the current network connections similar to net use .^[4]

Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.^[66]

PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.^[67]

Poseidon Group obtains and saves information about victim network interfaces and addresses.^[68]

PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.^[69]

POWRUNER may collect active network connections by running netstat -an on a victim.^[70]

Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.^[71]

PyDCrypt has used netsh to find RPC connections on remote machines.^[72]

QakBot can use netstat to enumerate current network connections.^[73][74]

Ramsay can use netstat to enumerate network connections.^[75]

RATANKBA uses netstat -ano to search for specific IP address ranges.^[76]

RedLeaves can enumerate drives and Remote Desktop sessions.^[77]

Remsec can obtain a list of active connections and open ports.^[78]

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.^[79][80]

Sardonic has the ability to execute the netstat command.^[81]

ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.^[82]

SHOTPUT uses netstat to list TCP connection status.^[83]

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.^[84]

Sliver can collect network connection information.^[85]

SLOTHFULMEDIA can enumerate open ports on a victim machine.^[86]

SpeakUp uses the arp -a command. ^[87]

Sykipot may use netstat -ano to display active network connections.^[88]

TeamTNT has run netstat -anp to search for rival malware connections.^[89] TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.^[90]

Threat Group-3390 has used net use and netstat to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.^[91]

ToddyCat has used netstat -anop tcp to discover TCP connections to compromised hosts.^[92]

Torisma can use WTSEnumerateSessionsW to monitor remote desktop connections.^[93]

Trojan.Karagany can use netstat to collect a list of network connections.^[94]

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.^[95]

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands.^[31][96] Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.^[97]

USBferry can use netstat and nbtstat to detect active network connections.^[95]

Volgmer can gather information about TCP connection state.^[98]

Volt Typhoon has used netstat -ano on compromised hosts to enumerate network connections.^[99][100]

Waterbear can use API hooks on GetExtendedTcpTable to retrieve a table containing a list of TCP endpoints available to the application.^[101]

Zebrocy uses netstat -aon to gather network connection information.^[102]