AN1583
Analytic 1583
Windows
Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
[TimeWindow]
Define bursty execution patterns of enumeration commands (e.g., <30s)
[CommandLinePattern]
Tunable per org’s scripting/IT tools (e.g., exclude SCCM, PsExec)
[ParentProcess]
Flag suspicious process ancestry (e.g., Word.exe spawning net.exe)
AN1584
Analytic 1584
Linux
Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.
auditd:EXECVE
execve
linux:syslog
network
[TargetIPRange]
Tune for sensitive internal segments or known lateral targets
[ShellContext]
Distinguish user-interactive enumeration vs. cronjob or baseline tooling
AN1585
Analytic 1585
macOS
Execution of built-in or AppleScript-based system enumeration via `arp`, `netstat`, `ping`, and discovery of `/etc/hosts` contents.
macos:unifiedlog
process
macos:osquery
file_events
[ExecutionUser]
Limit detection to suspicious users or automation contexts
[CommandSignature]
Adapt for expected enumeration tooling used in IT
AN1586
Analytic 1586
ESXi
ESXi shell or SSH access issuing `esxcli network diag ping` or viewing routing tables to identify connected hosts.
esxi:hostd
None
[ESXCommandPattern]
Match specific diag/debug commands abused for recon
[RemoteUserShell]
Detect unauthorized shell use or user context (e.g., root over SSH)
AN1587
Analytic 1587
Network Devices
Execution of discovery commands like `show cdp neighbors`, `show arp`, and other interface-level introspection on Cisco or Juniper devices.
networkdevice:syslog
syslog facility LOCAL7 or trap messages
[CommandList]
Device-specific recon commands to monitor based on make/model
[PrivLevel]
Trigger detection for privilege escalation prior to recon commands