# T1018 - Remote System Discovery
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1018)
<blockquote>Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as  [Ping](https://attack.mitre.org/software/S0097) or <code>net view</code> using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) in order to discover the hostname to IP address mappings of remote systems. 

Specific to macOS, the <code>bonjour</code> protocol exists to discover additional Mac-based systems within the same broadcast domain.</blockquote>

## Atomic Tests

- [Atomic Test #1 - Remote System Discovery - net](#atomic-test-1---remote-system-discovery---net)

- [Atomic Test #2 - Remote System Discovery - net group Domain Computers](#atomic-test-2---remote-system-discovery---net-group-domain-computers)

- [Atomic Test #3 - Remote System Discovery - nltest](#atomic-test-3---remote-system-discovery---nltest)

- [Atomic Test #4 - Remote System Discovery - ping sweep](#atomic-test-4---remote-system-discovery---ping-sweep)

- [Atomic Test #5 - Remote System Discovery - arp](#atomic-test-5---remote-system-discovery---arp)

- [Atomic Test #6 - Remote System Discovery - arp nix](#atomic-test-6---remote-system-discovery---arp-nix)

- [Atomic Test #7 - Remote System Discovery - sweep](#atomic-test-7---remote-system-discovery---sweep)

- [Atomic Test #8 - Remote System Discovery - nslookup](#atomic-test-8---remote-system-discovery---nslookup)

- [Atomic Test #9 - Remote System Discovery - adidnsdump](#atomic-test-9---remote-system-discovery---adidnsdump)

- [Atomic Test #10 - Adfind - Enumerate Active Directory Computer Objects](#atomic-test-10---adfind---enumerate-active-directory-computer-objects)

- [Atomic Test #11 - Adfind - Enumerate Active Directory Domain Controller Objects](#atomic-test-11---adfind---enumerate-active-directory-domain-controller-objects)

- [Atomic Test #12 - Remote System Discovery - ip neighbour](#atomic-test-12---remote-system-discovery---ip-neighbour)

- [Atomic Test #13 - Remote System Discovery - ip route](#atomic-test-13---remote-system-discovery---ip-route)

- [Atomic Test #14 - Remote System Discovery - ip tcp_metrics](#atomic-test-14---remote-system-discovery---ip-tcp_metrics)


<br/>

## Atomic Test #1 - Remote System Discovery - net
Identify remote systems with net.exe.

Upon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.

**Supported Platforms:** Windows


**auto_generated_guid:** 85321a9c-897f-4a60-9f20-29788e50bccd






#### Attack Commands: Run with `command_prompt`! 


```cmd
net view /domain
net view
```






<br/>
<br/>

## Atomic Test #2 - Remote System Discovery - net group Domain Computers
Identify remote systems with net.exe querying the Active Directory Domain Computers group.

Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** f1bf6c8f-9016-4edf-aff9-80b65f5d711f






#### Attack Commands: Run with `command_prompt`! 


```cmd
net group "Domain Computers" /domain
```






<br/>
<br/>

## Atomic Test #3 - Remote System Discovery - nltest
Identify domain controllers for specified domain.

Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** 52ab5108-3f6f-42fb-8ba3-73bc054f22c8





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| target_domain | Domain to query for domain controllers | String | %userdnsdomain%|


#### Attack Commands: Run with `command_prompt`! 


```cmd
nltest.exe /dclist:#{target_domain}
```






<br/>
<br/>

## Atomic Test #4 - Remote System Discovery - ping sweep
Identify remote systems via ping sweep.

Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** 6db1f57f-d1d5-4223-8a66-55c9c65a9592






#### Attack Commands: Run with `command_prompt`! 


```cmd
for /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i
```






<br/>
<br/>

## Atomic Test #5 - Remote System Discovery - arp
Identify remote systems via arp. 

Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** 2d5a61f5-0447-4be4-944a-1f8530ed6574






#### Attack Commands: Run with `command_prompt`! 


```cmd
arp -a
```






<br/>
<br/>

## Atomic Test #6 - Remote System Discovery - arp nix
Identify remote systems via arp.

Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** acb6b1ff-e2ad-4d64-806c-6c35fe73b951






#### Attack Commands: Run with `sh`! 


```sh
arp -a | grep -v '^?'
```




#### Dependencies:  Run with `sh`!
##### Description: Check if arp command exists on the machine
##### Check Prereq Commands:
```sh
if [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```sh
(which yum && yum -y install net-tools)||(which apt-get && apt-get install -y net-tools)
```




<br/>
<br/>

## Atomic Test #7 - Remote System Discovery - sweep
Identify remote systems via ping sweep.

Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.

**Supported Platforms:** Linux, macOS


**auto_generated_guid:** 96db2632-8417-4dbb-b8bb-a8b92ba391de





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| start_host | Subnet used for ping sweep. | String | 1|
| stop_host | Subnet used for ping sweep. | String | 254|
| subnet | Subnet used for ping sweep. | String | 192.168.1|


#### Attack Commands: Run with `sh`! 


```sh
for ip in $(seq #{start_host} #{stop_host}); do ping -c 1 #{subnet}.$ip; [ $? -eq 0 ] && echo "#{subnet}.$ip UP" || : ; done
```






<br/>
<br/>

## Atomic Test #8 - Remote System Discovery - nslookup
Powershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.

Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.

**Supported Platforms:** Windows


**auto_generated_guid:** baa01aaa-5e13-45ec-8a0d-e46c93c9760f






#### Attack Commands: Run with `powershell`!  Elevation Required (e.g. root or admin) 


```powershell
$localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1]
$pieces = $localip.split(".")
$firstOctet = $pieces[0]
$secondOctet = $pieces[1]
$thirdOctet = $pieces[2]
foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}
```






<br/>
<br/>

## Atomic Test #9 - Remote System Discovery - adidnsdump
This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks
Python 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.
Successful execution of this test will list dns zones in the terminal.

**Supported Platforms:** Windows


**auto_generated_guid:** 95e19466-469e-4316-86d2-1dc401b5a959





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | username including domain. | String | domain&#92;user|
| acct_pass | Account password. | String | password|
| host_name | hostname or ip address to connect to. | String | 192.168.1.1|


#### Attack Commands: Run with `command_prompt`!  Elevation Required (e.g. root or admin) 


```cmd
adidnsdump -u #{user_name} -p #{acct_pass} --print-zones #{host_name}
```




#### Dependencies:  Run with `powershell`!
##### Description: Computer must have python 3 installed
##### Check Prereq Commands:
```powershell
if (python --version) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
echo "Python 3 must be installed manually"
```
##### Description: Computer must have pip installed
##### Check Prereq Commands:
```powershell
if (pip3 -V) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
echo "PIP must be installed manually"
```
##### Description: adidnsdump must be installed and part of PATH
##### Check Prereq Commands:
```powershell
if (cmd /c adidnsdump -h) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
pip3 install adidnsdump
```




<br/>
<br/>

## Atomic Test #10 - Adfind - Enumerate Active Directory Computer Objects
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Computer Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

**Supported Platforms:** Windows


**auto_generated_guid:** a889f5be-2d54-4050-bd05-884578748bb4





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| adfind_path | Path to the AdFind executable | Path | PathToAtomicsFolder&#92;T1087.002&#92;src&#92;AdFind.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
#{adfind_path} -f (objectcategory=computer)
```




#### Dependencies:  Run with `powershell`!
##### Description: AdFind.exe must exist on disk at specified location (#{adfind_path})
##### Check Prereq Commands:
```powershell
if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
```




<br/>
<br/>

## Atomic Test #11 - Adfind - Enumerate Active Directory Domain Controller Objects
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Domain Controller Objects
reference- http://www.joeware.net/freetools/tools/adfind/, https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html

**Supported Platforms:** Windows


**auto_generated_guid:** 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| adfind_path | Path to the AdFind executable | Path | PathToAtomicsFolder&#92;T1087.002&#92;src&#92;AdFind.exe|


#### Attack Commands: Run with `command_prompt`! 


```cmd
#{adfind_path} -sc dclist
```




#### Dependencies:  Run with `powershell`!
##### Description: AdFind.exe must exist on disk at specified location (#{adfind_path})
##### Check Prereq Commands:
```powershell
if (Test-Path #{adfind_path}) {exit 0} else {exit 1}
```
##### Get Prereq Commands:
```powershell
Invoke-WebRequest -Uri "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1087.002/src/AdFind.exe" -OutFile #{adfind_path}
```




<br/>
<br/>

## Atomic Test #12 - Remote System Discovery - ip neighbour
Use the ip neighbour command to display the known link layer (ARP table) addresses for hosts sharing the same network segment.

**Supported Platforms:** Linux


**auto_generated_guid:** 158bd4dd-6359-40ab-b13c-285b9ef6fa25






#### Attack Commands: Run with `sh`! 


```sh
ip neighbour show
```




#### Dependencies:  Run with `sh`!
##### Description: Check if ip command exists on the machine
##### Check Prereq Commands:
```sh
if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```sh
apt-get install iproute2 -y
```




<br/>
<br/>

## Atomic Test #13 - Remote System Discovery - ip route
Use the ip route command to display the kernels routing tables.

**Supported Platforms:** Linux


**auto_generated_guid:** 1a4ebe70-31d0-417b-ade2-ef4cb3e7d0e1






#### Attack Commands: Run with `sh`! 


```sh
ip route show
```




#### Dependencies:  Run with `sh`!
##### Description: Check if ip command exists on the machine
##### Check Prereq Commands:
```sh
if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```sh
apt-get install iproute2 -y
```




<br/>
<br/>

## Atomic Test #14 - Remote System Discovery - ip tcp_metrics
Use the ip tcp_metrics command to display the recent cached entries for IPv4 and IPv6 source and destination addresses.

**Supported Platforms:** Linux


**auto_generated_guid:** 6c2da894-0b57-43cb-87af-46ea3b501388






#### Attack Commands: Run with `sh`! 


```sh
ip tcp_metrics show |grep --invert-match "^127\."
```




#### Dependencies:  Run with `sh`!
##### Description: Check if ip command exists on the machine
##### Check Prereq Commands:
```sh
if [ -x "$(command -v ip)" ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```sh
apt-get install iproute2 -y
```




<br/>
