System Network Connections Discovery

Before deciding where to go next inside a network, an attacker on a freshly compromised host often wants to know what that host is already talking to. Checking active and recent network connections is a fast, low-effort way to find that out, revealing other systems the host regularly communicates with, which can point straight at higher-value targets without any further scanning.

This is a narrower, more localized cousin of broader network scanning: rather than probing the wider network for what's reachable, it asks a much smaller question first: what is this specific machine already connected to, right now.

Once on a host, an attacker runs simple, built-in tools, netstat on Windows, netstat or lsof on Linux and macOS, to list current and recent network connections. The output shows which remote hosts and ports are in active or recent use, which is often enough on its own to identify likely next targets: a database server, a domain controller, a file share, all visible just from what the compromised host was already talking to.

This step is often the very first thing an attacker does immediately after gaining a foothold, precisely because it's fast, uses only tools already present on the system, and requires no network traffic of its own beyond the query itself.

Data source: process-execution telemetry for the connection-enumeration command and its arguments: auditd execve on Linux, Sysmon Event ID 1 or Security Event 4688 on Windows

{
  "host": {
    "name": "JUMP01"
  },
  "event": {
    "code": "1",
    "action": "start"
  },
  "process": {
    "name": "netstat.exe",
    "command_line": "netstat.exe -ano"
  }
}

Prebuilt Elastic rule: System Network Connections Discovery / Windows System Network Connections Discovery

Filter process-creation events for the relevant tools (netstat, lsof, or net.exe with connection-related arguments) and look at who ran them and from where. A single instance from an administrator's own session during normal hours is unremarkable; the same command run by an unexpected account, from an unexpected process (a web shell, a script interpreter that shouldn't be launching system utilities), or immediately after some other suspicious activity on the same host is a much stronger signal.

Correlating timing matters here specifically: this technique is frequently one of the very first things an attacker does after gaining access, so finding it clustered right after another suspicious event on the same host is often more meaningful than finding it in isolation.

These are completely ordinary administrative and troubleshooting tools, used constantly by IT staff, monitoring systems, and support scripts to diagnose connectivity issues. The bare fact that netstat ran proves very little on its own.

The distinguishing signal is context: a known administrator running it during a support ticket reads very differently from an unfamiliar account, an unusual parent process, or a host with no ordinary reason to have someone checking its connections at all. Look at the broader sequence of activity around it rather than judging the command in isolation.

• MITRE ATT&CK T1049: System Network Connections Discovery
• Elastic Security: System Network Connections Discovery

1 scenario in this catalog covers T1049. We don't name it — identifying the technique is part of what a scenario grades. Explore the dashboard →