huntrule

Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).

FreeReviewedSigma · Low · v1
Product
windows
Category
process_creation
Author
frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' (SigmaHQ), DRL 1.1
Published
2021-12-07
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process creation events where the command line matches common network configuration and discovery utilities (such as ipconfig /all, netsh interface show interface, arp -a, nbtstat -n, net config, and route print). Attackers often run these commands to collect local and remote network details for positioning, connectivity testing, and subsequent actions. The detection relies on process_creation telemetry, specifically the CommandLine field of the spawned process.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange
Suspicious Codepage Change Followed By Nltest Domain Trust Discovery
Suspicious Domain Trust Discovery Via Nltest
Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)
Suspicious Scheduled Task Enumerated (via process_creation)
Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)
Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)
Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)
Suspicious External IP Discovery via curl to ifconfig.me via process_creation
Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)
Windows Process Creation: Suspicious Network Configuration and Discovery Commands
Pivot detection · T1016 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.