T1049 — System Network Connections Discovery

Tactic: Discovery · Platforms: ESXi, IaaS, Linux, macOS, Network Devices, Windows

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. An adversary who gains access to a system that is part of a cloud-based environment may map out…

Sigma detection rules (6)

title: T1049 System Network Connections Discovery
id: e5421e34-e688-4c93-92cf-c04768aa9018
description: 'Detection of System Network Connections Discovery Across Platforms. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: SuspiciousParentProcesses, TimeWindow, CommandPatternList.'
references:
  - https://attack.mitre.org/techniques/T1049
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.discovery
  - attack.t1049

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_netstat_arp:
    Image|endswith:
      - '\netstat.exe'
      - '\arp.exe'
  selection_net_session:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    CommandLine|contains:
      - 'use'
      - 'session'

  condition: selection_netstat_arp or selection_net_session

falsepositives:
  - Very common benign network-troubleshooting activity.

level: informational

title: T1049 System Network Connections Discovery
id: ed093125-7c01-452c-b8c6-f71c910ae3df
description: 'Detection of System Network Connections Discovery Across Platforms, using tool-appropriate connection-listing flags per binary: netstat -tuln/-anp (not -i, which shows interface stats), ss -tuln/-anp, and lsof -i (the correct socket-listing flag for lsof only). (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UtilityNameList, UserContextScope, ExecutionFrequencyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1049
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.discovery
  - attack.t1049

logsource:
  category: process_creation
  product: linux

detection:
  selection_netstat:
    type: EXECVE
    a0|endswith: '/netstat'
    a1|contains:
      - '-tuln'
      - '-tulpn'
      - '-tunlp'
      - '-an'
      - '-anp'
      - '-ano'
  selection_ss:
    type: EXECVE
    a0|endswith: '/ss'
    a1|contains:
      - '-tuln'
      - '-tulpn'
      - '-tunlp'
      - '-anp'
      - '-an'
  selection_lsof:
    type: EXECVE
    a0|endswith: '/lsof'
    a1|contains: '-i'
  condition: 1 of selection_*

falsepositives:
  - Routine administrative and monitoring activity.

level: informational

title: T1049 System Network Connections Discovery
id: 132b7595-a306-40ee-90a2-e59361c49b54
description: 'Detection of System Network Connections Discovery Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ShellCommandWatchlist, TerminalBinaryDenylist.'
references:
  - https://attack.mitre.org/techniques/T1049
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.discovery
  - attack.t1049

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/netstat'
      - '/lsof'
      - '/nettop'
  selection_args:
    CommandLine|contains:
      - '-an'
      - '-i'
  condition: selection and selection_args

falsepositives:
  - Routine troubleshooting of open network connections by administrators.

level: informational

title: T1049 System Network Connections Discovery
id: f5edf1f6-a5ae-4887-9cf5-297feff2e6ea
description: 'Detection of System Network Connections Discovery Across Platforms. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ServicePrincipalAllowlist, BurstQueryThreshold.'
references:
  - https://attack.mitre.org/techniques/T1049
author: Shahrukh Khan
date: 2026-03-26
license: MIT
tags:
  - attack.discovery
  - attack.t1049

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName:
      - 'DescribeInstances'
      - 'DescribeNetworkInterfaces'
      - 'DescribeSecurityGroups'
      - 'DescribeVpcPeeringConnections'
      - 'DescribeVpcs'
  filter_service_principal:
    userIdentity.type: 'AWSService'

  condition: selection and not filter_service_principal

falsepositives:
  - Describe calls are extremely common from monitoring tools, CMDB sync jobs, and infrastructure-as-code plan runs, so this is best used as a burst-volume signal rather than single-event alerting.

level: informational

title: T1049 System Network Connections Discovery
id: 7b0e7aa1-54f0-46e2-8410-36260a1248c2
description: 'Detection of System Network Connections Discovery Across Platforms. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CommandPatternList, PrivilegedUserCheck.'
references:
  - https://attack.mitre.org/techniques/T1049
author: Shahrukh Khan
date: 2026-03-17
license: MIT
tags:
  - attack.discovery
  - attack.t1049

logsource:
  category: process_creation
  product: networkdevice
  service: cli

detection:
  selection:
    CommandLine|contains:
      - 'show ip route'
      - 'show arp'
      - 'show mac address-table'
      - 'show cdp neighbors'
      - 'show lldp neighbors'
      - 'show interfaces'
      - 'show vlan'
      - 'get system arp'
      - 'show session'
  condition: selection

falsepositives:
  - Routine operational troubleshooting or health-check scripts run by network engineers.

level: low

title: T1049 System Network Connections Discovery
id: 6301b6e8-e972-48d2-aa77-fd8a278e13c4
description: 'Detection of System Network Connections Discovery Across Platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionOriginCheck, ExpectedAdminAccessWindow.'
references:
  - https://attack.mitre.org/techniques/T1049
author: Shahrukh Khan
date: 2026-04-12
license: MIT
tags:
  - attack.discovery
  - attack.t1049

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: 'esxcli network ip connection list'

  condition: selection

falsepositives:
  - Monitoring agents and support diagnostic bundle generation regularly invoke esxcli network ip connection list during routine health checks.

level: informational

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1049 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan