T1016.001 — Internet Connection Discovery

Tactic: Discovery · Platforms: Windows, Linux, macOS, ESXi

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use…

Sub-technique of System Network Configuration Discovery (T1016).

Sigma detection rules (4)

title: "T1016.001 System Network Configuration Discovery: Internet Connection Discovery"
id: fe079ddb-0e11-49cb-a3af-d58370d19ab3
description: 'Behavioral Detection of Internet Connection Discovery. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: DestinationIP, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1016/001
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.discovery
  - attack.t1016.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_ping:
    Image|endswith: '\ping.exe'
    CommandLine|contains:
      - '8.8.8.8'
      - '1.1.1.1'

  selection_test:
    CommandLine|contains: 'Test-NetConnection'

  condition: 1 of selection_*

falsepositives:
  - Routine network-troubleshooting activity by users and IT staff.

level: informational

title: "T1016.001 System Network Configuration Discovery: Internet Connection Discovery"
id: 29a384d7-6eae-4d51-bc29-178b66c836d5
description: 'Behavioral Detection of Internet Connection Discovery. (Retargeted to the network_connection auditd telemetry that actually captures this techniques behavior; see logsource below.) Narrowed from any curl/wget/ping invocation to matches against well-known connectivity-check destinations (public DNS resolvers for ping; captive-portal/IP-echo endpoints for curl/wget) actually used for internet-reachability testing, and excludes known OS connectivity-check services (NetworkManager, systemd-networkd, wpa_supplicant) that legitimately query the same endpoints. Tune using: DomainPatterns, ProtocolType.'
references:
  - https://attack.mitre.org/techniques/T1016/001
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.discovery
  - attack.t1016.001

logsource:
  category: network_connection
  product: linux

detection:
  selection_ping:
    type: SYSCALL
    syscall: connect
    exe|endswith: '/ping'
    daddr:
      - '8.8.8.8'
      - '8.8.4.4'
      - '1.1.1.1'
      - '1.0.0.1'
      - '9.9.9.9'
  selection_curl_wget:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
  selection_curl_wget_target:
    - a1|contains:
        - 'connectivitycheck.gstatic.com'
        - 'detectportal.firefox.com'
        - 'www.msftconnecttest.com'
        - 'clients3.google.com'
        - 'nmcheck.gnome.org'
        - 'captive.apple.com'
        - 'icanhazip.com'
        - 'ifconfig.me'
        - 'ipinfo.io'
    - a2|contains:
        - 'connectivitycheck.gstatic.com'
        - 'detectportal.firefox.com'
        - 'www.msftconnecttest.com'
        - 'clients3.google.com'
        - 'nmcheck.gnome.org'
        - 'captive.apple.com'
        - 'icanhazip.com'
        - 'ifconfig.me'
        - 'ipinfo.io'
  filter_os_services:
    exe|endswith:
      - '/NetworkManager'
      - '/nm-applet'
      - '/systemd-networkd'
      - '/wpa_supplicant'

  condition: (selection_ping or (selection_curl_wget and selection_curl_wget_target)) and not filter_os_services

falsepositives:
  - Manual troubleshooting by admins pinging 8.8.8.8 or curling ifconfig.me/icanhazip.com to check egress IP is legitimate and will still match; ProtocolType/DomainPatterns tuning can further scope this to unexpected user contexts.

level: medium

title: "T1016.001 System Network Configuration Discovery: Internet Connection Discovery"
id: 741c0e88-e116-4234-a241-84d327801f50
description: 'Behavioral Detection of Internet Connection Discovery. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionFrequency, EnrichmentLevel.'
references:
  - https://attack.mitre.org/techniques/T1016/001
author: Shahrukh Khan
date: 2026-06-24
license: MIT
tags:
  - attack.discovery
  - attack.t1016.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/ping'
      - '/nc'
  selection_args:
    CommandLine|contains:
      - '-Is'
      - '-c 1'
      - '-zv'
  condition: selection and selection_args

falsepositives:
  - Connectivity check scripts run by MDM agents or captive portal detection tools.

level: informational

title: "T1016.001 System Network Configuration Discovery: Internet Connection Discovery"
id: d6eca0a3-f05e-43f3-8bcd-2ff48ac79af1
description: 'Behavioral Detection of Internet Connection Discovery. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SSHSessionOrigin, TargetIP.'
references:
  - https://attack.mitre.org/techniques/T1016/001
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.discovery
  - attack.t1016.001

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'vmkping'
      - 'esxcli network diag ping'
      - 'nslookup'
      - 'wget http'
      - 'curl http'

  condition: selection

falsepositives:
  - Administrators troubleshooting NTP, DNS, or general connectivity issues legitimately run vmkping and esxcli network diag ping.

level: low

Related sub-techniques

• T1016.002 Wi-Fi Discovery

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1016.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan