Remote System Discovery

What is Remote System Discovery?

“Remote System Discovery is documented as technique T1018 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Remote System Discovery activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of network discovery commands including ping sweep scripts, net view, nbtstat -A, and arp -a from workstations and servers that do not have administrative or network management roles.

2. 2

   Alert on Active Directory LDAP queries retrieving computer objects, particularly queries requesting all computer accounts or filtering for specific operating systems that attackers target for exploitation.

3. 3

   Detect ICMP sweep activity through NetFlow analysis, alerting on hosts generating ICMP echo requests to sequential IP ranges that extend beyond their normal communication partners within the environment.

4. 4

   Monitor DNS queries for reverse lookups against large IP ranges, which attackers use to enumerate hostnames associated with discovered IP addresses as a passive alternative to active scanning.

5. 5

   Track ARP cache reads from automation tools and scripts, as commands like arp -a provide a ready-made list of recently contacted hosts on the local network segment without generating additional network traffic.

Example Alerts

These realistic alert examples show what Remote System Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Remote System Discovery?

Detection centers on SIEM, Firewall telemetry for the discovery phase of the attack. Monitor for execution of network discovery commands including ping sweep scripts, net view, nbtstat -A, and arp -a from workstations and servers that do not have administrative or network management roles. Alert on Active Directory LDAP queries retrieving computer objects, particularly queries requesting all computer accounts or filtering for specific operating systems that attackers target for exploitation.

What does a Remote System Discovery alert look like?

A representative SIEM detection is "Ping Sweep Executed Across Internal Network" (medium severity): ICMP echo request flood detected from workstation WS-ACCT-011: 4,096 ping requests to the 10.10.0.0/20 internal subnet within 90 seconds. The workstation has an accounting function and should not be performing network discovery. The sweep received responses from 847 live hosts, providing the attacker with a comprehensive map of active systems on the internal network as a foundation for targeted lateral movement.

Which tools detect Remote System Discovery, and how can I practice?

Remote System Discovery (T1018) is best surfaced with SIEM, Firewall telemetry, which exposes the discovery signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.