ATT&CK technique

T1049

System Network Connections Discovery

Discovery 23 detections found

Detection rules

Source	Rule	Status	Updated
splunk	Windows System Network Connections Discovery Netsh	production	2026-10-02
elastic	Suspicious MS Office Child Process	production	2026-09-18
elastic	DNS Enumeration Detected via Defend for Containers	production	2026-09-18
elastic	Enumeration Command Spawned via WMIPrvSE	production	2026-09-18
elastic	Unusual Linux Network Connection Discovery	production	2026-09-18
elastic	Suspicious System Commands Executed by Previously Unknown Executable	production	2026-09-18
elastic	Suspicious JetBrains TeamCity Child Process	production	2026-09-18
splunk	Network Connection Discovery With Arp	production	2026-08-30
splunk	Windows Network Connection Discovery Via Net	production	2026-05-13
splunk	GetNetTcpconnection with PowerShell	production	2026-05-13
splunk	GetNetTcpconnection with PowerShell Script Block	production	2026-05-13
splunk	Windows Post Exploitation Risk Behavior	production	2026-05-13
splunk	Network Connection Discovery With Netstat	production	2026-05-13
splunk	Windows Common Abused Cmd Shell Risk Behavior	production	2026-05-13
sigma	Potential Pikabot Discovery Activity	test	2024-01-26
sigma	Use Get-NetTCPConnection	test	2023-10-27
sigma	System Network Connections Discovery Via Net.EXE	test	2023-02-21
sigma	HackTool - SharpView Execution	test	2023-02-14
sigma	System Network Connections Discovery - Linux	test	2023-01-17
sigma	Cisco Discovery	test	2023-01-04
sigma	System Network Connections Discovery - MacOs	test	2022-12-28
sigma	Use Get-NetTCPConnection - PowerShell Module	test	2022-12-02
sigma	Net.EXE Execution	test	2022-07-11