title: HackTool - SharpView Execution
id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
related:
- id: dcd74b95-3f36-4ed9-9598-0490951643aa
type: similar
status: test
description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
references:
- https://github.com/tevora-threat/SharpView/
- https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview
author: frack113
date: 2021-12-10
modified: 2023-02-14
tags:
- attack.discovery
- attack.t1049
- attack.t1069.002
- attack.t1482
- attack.t1135
- attack.t1033
logsource:
category: process_creation
product: windows
detection:
selection:
- OriginalFileName: 'SharpView.exe'
- Image|endswith: '\SharpView.exe'
- CommandLine|contains:
# - 'Add-DomainGroupMember'
# - 'Add-DomainObjectAcl'
# - 'Add-ObjectAcl'
- 'Add-RemoteConnection'
- 'Convert-ADName'
- 'ConvertFrom-SID'
- 'ConvertFrom-UACValue'
- 'Convert-SidToName'
# - 'ConvertTo-SID'
- 'Export-PowerViewCSV'
# - 'Find-DomainLocalGroupMember'
- 'Find-DomainObjectPropertyOutlier'
- 'Find-DomainProcess'
- 'Find-DomainShare'
- 'Find-DomainUserEvent'
- 'Find-DomainUserLocation'
- 'Find-ForeignGroup'
- 'Find-ForeignUser'
- 'Find-GPOComputerAdmin'
- 'Find-GPOLocation'
- 'Find-Interesting' # 'Find-InterestingDomainAcl', 'Find-InterestingDomainShareFile', 'Find-InterestingFile'
- 'Find-LocalAdminAccess'
- 'Find-ManagedSecurityGroups'
# - 'Get-ADObject'
- 'Get-CachedRDPConnection'
- 'Get-DFSshare'
# - 'Get-DNSRecord'
# - 'Get-DNSZone'
# - 'Get-Domain'
- 'Get-DomainComputer'
- 'Get-DomainController'
- 'Get-DomainDFSShare'
- 'Get-DomainDNSRecord'
# - 'Get-DomainDNSZone'
- 'Get-DomainFileServer'
- 'Get-DomainForeign' # 'Get-DomainForeignGroupMember', 'Get-DomainForeignUser'
- 'Get-DomainGPO' # 'Get-DomainGPOComputerLocalGroupMapping', 'Get-DomainGPOLocalGroup', 'Get-DomainGPOUserLocalGroupMapping'
- 'Get-DomainGroup' # 'Get-DomainGroupMember'
- 'Get-DomainGUIDMap'
- 'Get-DomainManagedSecurityGroup'
- 'Get-DomainObject' # 'Get-DomainObjectAcl'
- 'Get-DomainOU'
- 'Get-DomainPolicy' # 'Get-DomainPolicyData'
- 'Get-DomainSID'
- 'Get-DomainSite'
- 'Get-DomainSPNTicket'
- 'Get-DomainSubnet'
- 'Get-DomainTrust' # 'Get-DomainTrustMapping'
# - 'Get-DomainUser'
- 'Get-DomainUserEvent'
# - 'Get-Forest'
- 'Get-ForestDomain'
- 'Get-ForestGlobalCatalog'
- 'Get-ForestTrust'
- 'Get-GptTmpl'
- 'Get-GroupsXML'
# - 'Get-GUIDMap'
# - 'Get-IniContent'
# - 'Get-IPAddress'
- 'Get-LastLoggedOn'
- 'Get-LoggedOnLocal'
- 'Get-NetComputer' # 'Get-NetComputerSiteName'
- 'Get-NetDomain' # 'Get-NetDomainController', 'Get-NetDomainTrust'
- 'Get-NetFileServer'
- 'Get-NetForest' # 'Get-NetForestCatalog', 'Get-NetForestDomain', 'Get-NetForestTrust'
- 'Get-NetGPO' # 'Get-NetGPOGroup'
# - 'Get-NetGroup'
- 'Get-NetGroupMember'
- 'Get-NetLocalGroup' # 'Get-NetLocalGroupMember'
- 'Get-NetLoggedon'
- 'Get-NetOU'
- 'Get-NetProcess'
- 'Get-NetRDPSession'
- 'Get-NetSession'
- 'Get-NetShare'
- 'Get-NetSite'
- 'Get-NetSubnet'
- 'Get-NetUser'
# - 'Get-ObjectAcl'
- 'Get-PathAcl'
- 'Get-PrincipalContext'
# - 'Get-Proxy'
- 'Get-RegistryMountedDrive'
- 'Get-RegLoggedOn'
# - 'Get-SiteName'
# - 'Get-UserEvent'
# - 'Get-WMIProcess'
- 'Get-WMIRegCachedRDPConnection'
- 'Get-WMIRegLastLoggedOn'
- 'Get-WMIRegMountedDrive'
- 'Get-WMIRegProxy'
- 'Invoke-ACLScanner'
- 'Invoke-CheckLocalAdminAccess'
- 'Invoke-Kerberoast'
- 'Invoke-MapDomainTrust'
- 'Invoke-RevertToSelf'
- 'Invoke-Sharefinder'
- 'Invoke-UserImpersonation'
# - 'New-DomainGroup'
# - 'New-DomainUser'
- 'Remove-DomainObjectAcl'
- 'Remove-RemoteConnection'
- 'Request-SPNTicket'
# - 'Resolve-IPAddress'
# - 'Set-ADObject'
- 'Set-DomainObject'
# - 'Set-DomainUserPassword'
- 'Test-AdminAccess'
condition: selection
falsepositives:
- Unknown
level: high
title: Cisco Discovery
id: 9705a6a1-6db6-4a16-a987-15b7151e299b
status: test
description: Find information about network devices that is not stored in config files
references:
- https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html
author: Austin Clark
date: 2019-08-12
modified: 2023-01-04
tags:
- attack.discovery
- attack.t1083
- attack.t1201
- attack.t1057
- attack.t1018
- attack.t1082
- attack.t1016
- attack.t1049
- attack.t1033
- attack.t1124
logsource:
product: cisco
service: aaa
detection:
keywords:
- 'dir'
- 'show arp'
- 'show cdp'
- 'show clock'
- 'show ip interface'
- 'show ip route'
- 'show ip sockets'
- 'show processes'
- 'show ssh'
- 'show users'
- 'show version'
condition: keywords
falsepositives:
- Commonly used by administrators for troubleshooting
level: low
title: System Network Connections Discovery - Linux
id: 4c519226-f0cd-4471-bd2f-6fbb2bb68a79
status: test
description: Detects usage of system utilities to discover system network connections
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md
author: Daniil Yugoslavskiy, oscd.community
date: 2020-10-19
modified: 2023-01-17
tags:
- attack.discovery
- attack.t1049
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- '/who'
- '/w'
- '/last'
- '/lsof'
- '/netstat'
filter_landscape_sysinfo:
ParentCommandLine|contains: '/usr/bin/landscape-sysinfo'
Image|endswith: '/who'
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate activities
level: low
title: System Network Connections Discovery Via Net.EXE
id: 1c67a717-32ba-409b-a45d-0fb704a73a81
status: test
description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
author: frack113
date: 2021-12-10
modified: 2023-02-21
tags:
- attack.discovery
- attack.t1049
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- '\net.exe'
- '\net1.exe'
- OriginalFileName:
- 'net.exe'
- 'net1.exe'
selection_cli:
- CommandLine|endswith:
- ' use'
- ' sessions'
- CommandLine|contains:
- ' use '
- ' sessions '
condition: all of selection_*
falsepositives:
- Unknown
level: low
title: Use Get-NetTCPConnection
id: b366adb4-d63d-422d-8a2c-186463b5ded0
status: test
description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell
author: frack113
date: 2021-12-10
modified: 2023-10-27
tags:
- attack.discovery
- attack.t1049
logsource:
product: windows
category: ps_classic_start
detection:
selection:
Data|contains: 'Get-NetTCPConnection'
condition: selection
falsepositives:
- Unknown
level: low
title: Use Get-NetTCPConnection - PowerShell Module
id: aff815cc-e400-4bf0-a47a-5d8a2407d4e1
status: test
description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell
author: frack113
date: 2021-12-10
modified: 2022-12-02
tags:
- attack.discovery
- attack.t1049
logsource:
product: windows
category: ps_module
definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
selection:
ContextInfo|contains: 'Get-NetTCPConnection'
condition: selection
falsepositives:
- Unknown
level: low
title: System Network Connections Discovery - MacOs
id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db
status: test
description: Detects usage of system utilities to discover system network connections
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md
author: Daniil Yugoslavskiy, oscd.community
date: 2020-10-19
modified: 2022-12-28
tags:
- attack.discovery
- attack.t1049
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- '/who'
- '/w'
- '/last'
- '/lsof'
- '/netstat'
condition: selection
falsepositives:
- Legitimate activities
level: informational