T1016.001 Internet Connection Discovery

T1016.001 Internet Connection Discovery

Sub-technique of: T1016

High-Level Description

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth.

Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Windows, Linux, macOS, ESXi

What to Check

• Identify if Internet Connection Discovery technique is applicable to target environment
• Check Windows systems for indicators of Internet Connection Discovery
• Check Linux systems for indicators of Internet Connection Discovery
• Check macOS systems for indicators of Internet Connection Discovery
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Check internet connection using ping Windows

Check internet connection using ping on Windows. The default target of the ping is 8.8.8.8 (Google Public DNS).

Supported Platforms: windows

ping -n 4 #{ping_target}