T1018 — Remote System Discovery

Tactic: Discovery · Platforms: ESXi, Linux, macOS, Network Devices, Windows

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating…

Sigma detection rules (5)

title: T1018 Remote System Discovery
id: 52ac78f7-d52d-49e7-bd21-13aeea3ef290
description: 'Detection Strategy for Remote System Enumeration Behavior via native Windows discovery utilities (net view, nbtstat, arp, dsquery, Get-ADComputer). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, CommandLinePattern, ParentProcess.'
references:
  - https://attack.mitre.org/techniques/T1018
author: Shahrukh Khan
date: 2026-02-08
license: MIT
tags:
  - attack.discovery
  - attack.t1018

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_net_view:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains: 'view'
  selection_nbtstat:
    Image|endswith: '\nbtstat.exe'
    CommandLine|contains:
      - '-a'
      - '-A'
  selection_arp:
    Image|endswith: '\arp.exe'
    CommandLine|contains: '-a'
  selection_dsquery:
    Image|endswith: '\dsquery.exe'
    CommandLine|contains: 'computer'
  selection_ps_adcomputer:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Get-ADComputer'
      - 'Get-NetComputer'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (1 of selection_*) and not filter_system_account

falsepositives:
  - IT/helpdesk staff and monitoring/inventory tools legitimately enumerating hosts via net view, nbtstat, arp, or AD cmdlets.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: T1018 Remote System Discovery
id: 9335e596-238a-43c6-bf1e-f903efb4e6cb
description: 'Detects lightweight remote-host-enumeration behaviors actually cited for T1018: ICMP ping sweeps (fping, or repeated ping), ARP cache/table review (arp -a, ip neigh show), and review of the local /etc/hosts file (cat/grep). Previously this rule keyed on nmap/masscan/arp-scan, heavier port/service scanners characteristic of the sibling technique T1046 (Network Service Discovery) rather than T1018''s described behaviors; those have been removed from this rule. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TargetIPRange, ShellContext.'
references:
  - https://attack.mitre.org/techniques/T1018
author: Shahrukh Khan
date: 2026-03-29
license: MIT
tags:
  - attack.discovery
  - attack.t1018

logsource:
  category: process_creation
  product: linux

detection:
  selection_fping:
    type: EXECVE
    a0|endswith: '/fping'
  selection_ping:
    type: EXECVE
    a0|endswith: '/ping'
  selection_arp:
    type: EXECVE
    a0|endswith: '/arp'
    a1|contains: '-a'
  selection_ip_neigh:
    type: EXECVE
    a0|endswith: '/ip'
    a1: 'neigh'
  selection_hosts_file:
    type: EXECVE
    a0|endswith:
      - '/cat'
      - '/grep'
    a1|contains: '/etc/hosts'

  condition: 1 of selection_*

falsepositives:
  - Authorized network inventory scans and routine connectivity troubleshooting (ping, arp -a, ip neigh, viewing /etc/hosts) by IT/security teams or provisioning automation using the same tooling.

level: low

title: T1018 Remote System Discovery
id: 668f60ed-d96b-4b47-b099-cca72dcd43ef
description: 'Detection Strategy for Remote System Enumeration Behavior. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionUser, CommandSignature.'
references:
  - https://attack.mitre.org/techniques/T1018
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.discovery
  - attack.t1018

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/arp'
      - '/dscacheutil'
      - '/nmap'
  selection_args:
    CommandLine|contains:
      - '-a'
      - '-q host'
  condition: selection and selection_args

falsepositives:
  - Legitimate network administration or asset-discovery tooling scanning the local subnet.

level: informational

title: T1018 Remote System Discovery
id: 0f0bac5e-f9a9-4a36-880a-1ff1b147975c
description: 'Detection Strategy for Remote System Enumeration Behavior. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CommandList, PrivLevel.'
references:
  - https://attack.mitre.org/techniques/T1018
author: Shahrukh Khan
date: 2026-01-06
license: MIT
tags:
  - attack.discovery
  - attack.t1018

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/nmap'
      - '/arp'
      - '/getent'
      - '/nslookup'
      - '/dig'

  condition: selection

falsepositives:
  - Network and system administrators routinely run the same host enumeration commands during legitimate inventory or troubleshooting work.

level: medium

title: T1018 Remote System Discovery
id: 2dab21a7-23de-4fb9-b6cf-d880fbd47810
description: 'Detection Strategy for Remote System Enumeration Behavior. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ESXCommandPattern, RemoteUserShell.'
references:
  - https://attack.mitre.org/techniques/T1018
author: Shahrukh Khan
date: 2026-04-06
license: MIT
tags:
  - attack.discovery
  - attack.t1018

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'esxcli network ip neighbor list'
      - 'vim-cmd hostsvc/hostsummary'
      - 'esxcli system hostname get'

  condition: selection

falsepositives:
  - Cluster health monitoring and HA or DRS reconfiguration operations regularly enumerate peer hosts using the same commands.

level: informational

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1018 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan