T1016: System Network Configuration Discovery
AI Answer
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). Adversaries may also leverage a [Network (Source: MITRE ATT&CK T1016)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1016 |
| Name | System Network Configuration Discovery |
| Tactic | Discovery (discovery) |
| Platforms | ESXi, Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, System Network Configuration Discovery (T1016) is one of the highest-connectivity ATT&CK techniques: 289 MITRE STIX relationships reference this technique; 44 threat groups observed using it; 232 software families associated; 13 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1016).
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route. Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. show ip route, show ip interface). On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command esxcli network nic list will retrieve the MAC address, while esxcli network ip interface ipv4 get will retrieve the local IPv4 address. Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Detection
DET0195 Behavioral Detection of System Network Configuration Discovery AN0559 Execution of built-in tools (e.g., ipconfig, route, netsh) or PowerShell/WMI queries to enumerate IP, MAC, interface status, or routing configuration. AN0560 Execution of ifconfig , ip a , or access to /proc/net/ indicating collection of local interface and route configuration. AN0561 Execution of ifconfig , networksetup , or system_profiler to query IP/MAC/interface configuration and status. AN0562 Use of esxcli network commands (e.g., esxcli network nic list , esxcli network ip interface ipv4 get ) via SSH or hostd to enumerate adapter and IP information. AN0563 CLI-based execution of interface and routing discovery commands (e.g., show ip interface , show arp , show route ) over Telnet, SSH, or console.
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1016).
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- TrickBot
- cd00r
- PowerDuke
- EKANS
- BLINDINGCAN
- Ninja
- Pikabot
- Amadey
- Proxysvc
- Orz
- Torisma
- NOKKI
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- BlackByte
- SideCopy
- GALLIUM
- APT3
- Kimsuky
- admin@338
- Volt Typhoon
- APT41
- Dragonfly
- menuPass
- APT32
- HAFNIUM
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- KV Botnet Activity
- Frankenstein
- RedPenguin
- C0018
- ShadowRay
- Anthropic AI-orchestrated Campaign
- C0015
- Operation AkaiRyū
- FunnyDream
- Operation CuckooBees
- 2025 Poland Wiper Attacks
- Operation Wocao
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1016 System Network Configuration Discovery. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1016 System Network Configuration Discovery?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.