Home/ATT&CK Technique/Internet Connection Discovery
ATT&CK Technique

Internet Connection Discovery

T1016.001 · discovery

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them.

The results may also be used to identify routes, redirectors, and proxy servers.

WindowsLinuxmacOSESXi
◆

Actors Using This

6
russiaAPT29
north_koreaKimsuky
iranMuddyWater
turkeySea Turtle
russiaTurla
chinaVolt Typhoon
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
reconnaissance earlier
T1593 · Search Open Websites/Domains ×8.50T1589 · Gather Victim Identity Information ×6.35T1589.002 · Email Addresses ×5.17
execution earlier
T1059.006 · Python ×5.29
persistence earlier
T1098.005 · Device Registration ×9.92
privilege-escalation earlier
T1546.003 · Windows Management Instrumentation Event Subscription ×39.67T1546.015 · Component Object Model Hijacking ×11.90T1546 · Event Triggered Execution ×5.09
discovery same
T1007 · System Service Discovery ×39.67T1124 · System Time Discovery ×39.67T1680 · Local Storage Discovery ×23.80T1069.001 · Local Groups ×10.82T1069.002 · Domain Groups ×7.93
other same
T1070.006 · Timestomp ×5.47T1027.010 · Command Obfuscation ×5.29
▸

Atomic Tests

5
Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
command_promptwindowsCheck internet connection using ping Windows
Check internet connection using ping on Windows. The default target of the ping is 8.8.8.8 (Google Public DNS). 
ping -n 4 #{ping_target}
bashmacos, linuxCheck internet connection using ping freebsd, linux or macos
Check internet connection using ping on Linux, MACOS. The default target of the ping is 8.8.8.8 (Google Public DNS). 
ping -c 4 #{ping_target}
powershellwindowsCheck internet connection using Test-NetConnection in PowerShell (ICMP-Ping)
Check internet connection using PowerShell's Test-NetConnection cmdlet and the ICMP/Ping protocol. The default target is 8.8.8.8 (Google Public DNS). 
Test-NetConnection -ComputerName #{target}
powershellwindowsCheck internet connection using Test-NetConnection in PowerShell (TCP-HTTP)
Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound HTTP (Port 80) access. The default target is www.google.com. 
Test-NetConnection -CommonTCPPort HTTP -ComputerName #{target}
powershellwindowsCheck internet connection using Test-NetConnection in PowerShell (TCP-SMB)
Check internet connection using PowerShell's Test-NetConnection cmdlet and the TCP protocol to check for outbound SMB (Port 445) access. The default target is 8.8.8.8. 
Test-NetConnection -CommonTCPPort SMB -ComputerName #{target}
◈

Detection Coverage

0/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin