AN0559
Analytic 0559
Windows
Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[ParentProcess]
Filter known/legit CLI chains (e.g., explorer.exe → cmd.exe) to reduce FP
[UserContext]
Target executions by non-admin or unexpected users
[TimeWindow]
Cluster enumeration commands within short time windows
AN0560
Analytic 0560
Linux
Execution of `ifconfig`, `ip a`, or access to `/proc/net/` indicating collection of local interface and route configuration.
auditd:EXECVE
execve
[CommandLinePattern]
Match regex for variations in enumeration syntax (e.g., `ip -4 addr show`)
[InteractiveShellIndicator]
Differentiate scripted versus interactive sessions
AN0561
Analytic 0561
macOS
Execution of `ifconfig`, `networksetup`, or `system_profiler` to query IP/MAC/interface configuration and status.
macos:unifiedlog
process
[ScriptedContext]
Scripted tools (e.g., bash calling `ifconfig`) vs GUI-initiated inspection
[ExecutionFrequency]
Enumerations executed frequently or across multiple interfaces may indicate enumeration loops
AN0562
Analytic 0562
ESXi
Use of `esxcli network` commands (e.g., `esxcli network nic list`, `esxcli network ip interface ipv4 get`) via SSH or hostd to enumerate adapter and IP information.
esxi:hostd
None
[SSHSessionOrigin]
Detection may vary based on internal vs remote terminal usage
[esxcliCommandDepth]
Distinguish between benign status checks and deep enumeration chains
AN0563
Analytic 0563
Network Devices
CLI-based execution of interface and routing discovery commands (e.g., `show ip interface`, `show arp`, `show route`) over Telnet, SSH, or console.
networkdevice:cli
None
[Username]
Highlight low-privileged or non-routine users performing discovery
[CommandString]
Allow for tuning based on command regex or frequency
[TransportType]
SSH vs Telnet vs Console session logging scope