T1018 Remote System Discovery is an adversary listing other hosts to pick lateral-movement targets, using built-ins such as net view, nltest /dclist, ping and arp, or AD tools like AdFind and Get-ADComputer. Detect it in process creation logs (4688 with command line, Sysmon Event ID 1) when a host with no IT role runs several in minutes.
Practice detecting Remote System Discovery on realistic SIEM, Firewall alerts in SOCSimulator Operations.
“Remote System Discovery is documented as technique T1018 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into SIEM, Firewall telemetry.”
The following detection strategies help SOC analysts identify Remote System Discovery activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
Hunt on the full command line. Event 4688 carries Process Command Line only after the "Include command line in process creation events" policy is enabled, and it is off by default; Sysmon Event ID 1 logs the full command line plus a ProcessGUID for correlation. Flag net view /domain, net group "Domain computers", nltest /dclist: or /dsgetdc and Get-ADComputer -Filter * when two or more come from the same parent within minutes. FIN8, HAFNIUM and Wizard Spider all ran nltest /dclist, and APT29 used AdFind in the SolarWinds intrusion.
A cmdlet runs inside the PowerShell process, so Get-ADComputer typed in an open session leaves no 4688 or Sysmon 1 of its own. Turn on script block logging and search event 4104 in the Microsoft-Windows-PowerShell/Operational log for Get-ADComputer -Filter * or an LDAPFilter that returns every computer object, especially from an account outside IT.
Catch ping sweeps on the network side. Sysmon Event ID 3 records only TCP and UDP connections and ships disabled, so ICMP never reaches it; use NetFlow or firewall logs and alert when one internal host sends echo requests across a sequential range far beyond its usual peers.
Monitor DNS queries for reverse lookups against large IP ranges, which attackers use to enumerate hostnames associated with discovered IP addresses as a passive alternative to active scanning.
Track ARP cache reads from automation tools and scripts, as commands like arp -a provide a ready-made list of recently contacted hosts on the local network segment without generating additional network traffic.
These realistic alert examples show what Remote System Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
ICMP echo request flood detected from workstation WS-ACCT-011: 4,096 ping requests to the 10.10.0.0/20 internal subnet within 90 seconds. The workstation has an accounting function and should not be performing network discovery. The sweep received responses from 847 live hosts, providing the attacker with a comprehensive map of active systems on the internal network as a foundation for targeted lateral movement.
LDAP query analysis detected workstation WS-SALES-033 querying Active Directory for all computer objects with their associated attributes including operating system version, last logon time, and organizational unit. Retrieval of all 3,847 computer accounts in a single query from a sales workstation with no IT function is consistent with post-compromise environment mapping to identify high-value targets such as servers running outdated operating systems.
Process execution detected: net view /domain executed followed by net view \\FILESERVER-01 and net view \\DC-PRIMARY to enumerate shares and sessions on discovered hosts. These commands provide information about network resources and currently authenticated users that helps attackers identify active sessions to hijack and file shares containing data worth exfiltrating. The commands were run by a standard user account with no administrative responsibilities.
We cover Remote System Discovery in our Pro simulations. You can also practice the surrounding detection skills for free across SOCSimulator Operations.
In this scenario, a threat actor has gained a foothold in a corporate environment. You will serve as a SOC Analyst tasked with identifying the initial infection vector, tracing lateral movement, and uncovering the final objectives of the intrusion. This room focuses on detecting beacon traffic, process injection patterns, and the hands-on-keyboard activity that precedes encryption. You will utilize SIEM logs and XDR telemetry to reconstruct the attack timeline and identify critical Indicators of Compromise (IOCs).
No malware, no ransomware, no payload to scan for, just native Windows binaries used in an abnormal sequence and a stolen administrator credential. A stealth operator plants a tiny web shell on a water utility's internet-facing host, dumps LSASS with a signed system DLL, routes C2 through a compromised home router, and exports the entire Active Directory database off the domain controller before clearing the logs. Work the Windows Security log, the endpoint process tree, and the perimeter traffic to separate the living-off-the-land activity from a heavy baseline of legitimate admin work.
The SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ToolThe Firewall console in SOCSimulator replicates the log analysis experience of enterprise platforms like Palo Alto Netwo…
Read more GlossaryLateral movement is the attack phase where adversaries expand access from an initial foothold to additional systems, usi…
Read more GlossaryNDR (network detection and response) is security software that analyzes network traffic, as raw packets or flow metadata…
Read more GlossaryThreat hunting is the proactive search through security telemetry for attackers that existing controls missed. The hunte…
Read more GlossarySecurity Information and Event Management (SIEM) is a platform that aggregates, normalizes, and correlates log data from…
Read more Career PathThreat Hunters do not wait for alerts. You develop hypotheses based on threat intelligence and adversary behavior models…
Read more Career PathTier 2 SOC Analysts handle the investigations that Tier 1 escalates. You dig into multi-stage attacks, coordinate contai…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureStructured CTF-style investigation operations covering real-world attack scenarios.
Read more