System Network Connections Discovery

What is System Network Connections Discovery?

“System Network Connections Discovery is documented as technique T1049 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify System Network Connections Discovery activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of network connection enumeration commands including netstat -ano, netstat -b, Get-NetTCPConnection, and ss -tulpn from non-administrative accounts or from processes that do not normally query network state.

2. 2

   Alert on network connection discovery commands executed in rapid succession with system information and process discovery commands, as this combination indicates comprehensive post-compromise reconnaissance rather than isolated administrative activity.

3. 3

   Detect automated querying of network connection state at high frequency, as post-exploitation frameworks perform continuous network state monitoring to track changes in active sessions and identify opportunities for lateral movement.

4. 4

   Monitor for scripts or tools enumerating listening services and their port numbers, as attackers use this information to identify locally running services that can be exploited for privilege escalation or used as pivot points.

5. 5

   Track access to routing table information using route print and netstat -r, which attackers examine to understand network segmentation and identify routes to restricted network segments not directly accessible from the current position.

Example Alerts

These realistic alert examples show what System Network Connections Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect System Network Connections Discovery?

Detection centers on XDR, SIEM telemetry for the discovery phase of the attack. Monitor for execution of network connection enumeration commands including netstat -ano, netstat -b, Get-NetTCPConnection, and ss -tulpn from non-administrative accounts or from processes that do not normally query network state. Alert on network connection discovery commands executed in rapid succession with system information and process discovery commands, as this combination indicates comprehensive post-compromise reconnaissance rather than isolated administrative activity.

What does a System Network Connections Discovery alert look like?

A representative XDR detection is "Network State Enumeration as Part of Reconnaissance Chain" (medium severity): Command execution sequence detected on compromised server: ipconfig /all, arp -a, netstat -ano, and route print executed within 45 seconds by a PowerShell process. This systematic collection of network configuration, connection state, and routing information provides a complete picture of the server network posture and reachable network segments. The sequence is a standard post-exploitation reconnaissance pattern used to plan subsequent lateral movement.

Which tools detect System Network Connections Discovery, and how can I practice?

System Network Connections Discovery (T1049) is best surfaced with XDR, SIEM telemetry, which exposes the discovery signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.