AN0903
Analytic 0903
Windows
Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
[SuspiciousParentProcesses]
Non-standard binaries launching PowerShell or netstat (e.g., winword.exe spawning powershell.exe).
[TimeWindow]
Correlates discovery behavior before lateral movement or credential access.
[CommandPatternList]
Regex or keyword patterns to match discovery utilities (e.g., `netstat`, `Get-NetTCPConnection`).
AN0904
Analytic 0904
Linux
Detects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.
auditd:SYSCALL
execve
linux:cli
command logging
[UtilityNameList]
List of binaries used for discovery (e.g., netstat, ss, lsof).
[UserContextScope]
Limit detection to non-administrative or service accounts performing enumeration.
[ExecutionFrequencyThreshold]
Unusual number of executions within a short time window.
AN0905
Analytic 0905
macOS
Detects shell-based enumeration of active connections using `netstat`, `lsof -i`, or AppleScript-based system discovery.
macos:osquery
process_events
[ShellCommandWatchlist]
Matches terminal commands like `lsof -i`, `netstat`, or scripts issued via Automator or AppleScript.
[TerminalBinaryDenylist]
Tracks execution of networking discovery tools by apps outside Terminal.app or iTerm.
AN0906
Analytic 0906
ESXi
Detects shell or API usage of `esxcli network ip connection list` or `netstat` to enumerate ESXi host connections.
esxi:hostd
command log
[ExecutionOriginCheck]
Detect commands executed outside normal management interfaces (e.g., SSH or root shell).
[ExpectedAdminAccessWindow]
Timeframe when host connection audits are expected (e.g., maintenance windows).
AN0907
Analytic 0907
Network Devices
Detects interactive or automated use of CLI commands like `show ip sockets`, `show tcp brief`, or SNMP queries for active sessions on routers/switches.
networkdevice:cli
command logs
snmp:trap
management queries
[CommandPatternList]
Monitors for known socket/session query strings.
[PrivilegedUserCheck]
Restrict detections to non-admin roles executing advanced queries.
AN0908
Analytic 0908
IaaS
Detects enumeration of cloud network interfaces, VPCs, subnets, or peer connections using CLI or SDKs (e.g., AWS CLI, Azure CLI, GCloud CLI).
AWS:CloudTrail
Describe* or List* API calls
azure:activity
networkInsightsLogs
[ServicePrincipalAllowlist]
Allow certain automation roles to perform discovery during provisioning.
[BurstQueryThreshold]
Unusual number of Describe* or List* network API calls in a short timeframe.