Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1018_remote-system-discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
Passed 21 of 23 test cases with the skill, and 15 of 23 without it.
and 7 more in the full report
7 fixed14 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Which primary platform categories are formally covered under MITRE ATT&CK T1018 Remote System Discovery?
| Checked | Without skill | With skill |
|---|---|---|
| Includes ESXi in the supported platforms list. | Missed | Passed |
| Includes Network Devices in the supported platforms list. | Passed | Passed |
| Includes macOS in the supported platforms list. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, net view using Net, or, on ESXi servers, esxcli network diag ping.
Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment.
Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network (e.g. show cdp neighbors, show arp).
Platforms: ESXi, Linux, macOS, Network Devices, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Identify remote systems with net.exe.
Upon successful execution, cmd.exe will execute net.exe view and display results of local systems on the network that have file and print sharing enabled.
Supported Platforms: windows
net view /domain
test cases passed, vs 15 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.