Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).

FreeUnreviewedSigmalowv1

windows-process-creation-suspicious-network-configuration-and-discovery-commands-a29c1813

title: "Windows Process Creation: Suspicious Network Configuration and Discovery Commands"
id: 5fe0e669-bcc3-4526-abf9-c36847eb82bf
status: test
description: This rule flags Windows process creation events where the command line matches common network configuration and discovery utilities (such as ipconfig /all, netsh interface show interface, arp -a, nbtstat -n, net config, and route print). Attackers often run these commands to collect local and remote network details for positioning, connectivity testing, and subsequent actions. The detection relies on process_creation telemetry, specifically the CommandLine field of the spawned process.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-1---system-network-configuration-discovery-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_network_command.yml
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule Team
date: 2021-12-07
modified: 2025-10-19
tags:
  - attack.discovery
  - attack.t1016
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re:
      - ipconfig\s+/all
      - netsh\s+interface show interface
      - arp\s+-a
      - nbtstat\s+-n
      - net\s+config
      - route\s+print
  condition: selection
falsepositives:
  - Administrator, hotline ask to user
level: low
license: DRL-1.1
related:
  - id: a29c1813-ab1f-4dde-b489-330b952e91ae
    type: derived

What it detects

This rule flags Windows process creation events where the command line matches common network configuration and discovery utilities (such as ipconfig /all, netsh interface show interface, arp -a, nbtstat -n, net config, and route print). Attackers often run these commands to collect local and remote network details for positioning, connectivity testing, and subsequent actions. The detection relies on process_creation telemetry, specifically the CommandLine field of the spawned process.

Known false positives

Administrator, hotline ask to user

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.