T1018 · Remote System Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1018 · Remote System Discovery · Sunturai

attack-patternenterprise-attackT1018

Remote System Discovery

attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).(Citation: US-CERT-TA18-106A) (Citation: CISA AR21-126A FIVEHANDS May 2021)

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

64 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Silverfort - Lateral movement target discovery	High	Microsoft Sentinel analytics	Oct 14, 2026	MIT License
Windows AdFind Exe	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
Remote System Discovery with Adsisearcher	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
GetWmiObject Ds Computer with PowerShell	Informational	Splunk security content	Oct 13, 2026	Apache License 2.0
GetDomainController with PowerShell	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
GetAdComputer with PowerShell Script Block	Medium	Splunk security content	Oct 13, 2026	Apache License 2.0
AdFind Command Activity	Low	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Enumeration Command Spawned via WMIPrvSE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Enumerating Domain Trusts via NLTEST.EXE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Enumerating Domain Trusts via DSQUERY.EXE	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Active Directory Discovery using AdExplorer	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Enumeration via Active Directory Web Service	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Network Sweep Detected	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
ICMP Timestamp or Information Request from the Internet	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Spike in Firewall Denies	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Subnet Scanning Activity from Compromised Host	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Network Scan Executed From Host	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
DNS Enumeration Detected via Defend for Containers	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Newly Seen Commonly Abused Network Scanner	Medium	Elastic detection rules	Sep 16, 2026	Elastic License 2.0
Probable AdFind Recon Tool Usage	High	—	Sep 4, 2026	MIT License
Probable AdFind Recon Tool Usage (Normalized Process Events)	High	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Tailscale: Subnet router CIDR exposure inventory	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Tailscale Premium: New src->dst node pairs (lateral movement candidates)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Tailscale Premium: Mass fan-out from single node	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
SonicWall - Allowed SSH, Telnet, and RDP Connections	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 25 of 64

Filter in the catalogue

External references

mitre-attackT1018Open reference

CISA AR21-126A FIVEHANDS May 2021Open reference

Elastic - Koadiac Detection with EQLOpen reference

US-CERT-TA18-106AOpen reference

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object