Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Alerts on Windows command-line usage of network configuration and discovery tools (ipconfig, netsh, arp, nbtstat, net config, route print).

FreeReviewedSigma · Low · v1

Product: windows
Category: process_creation
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' (SigmaHQ), DRL 1.1
Published: 2021-12-07
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the command line matches common network configuration and discovery utilities (such as ipconfig /all, netsh interface show interface, arp -a, nbtstat -n, net config, and route print). Attackers often run these commands to collect local and remote network details for positioning, connectivity testing, and subsequent actions. The detection relies on process_creation telemetry, specifically the CommandLine field of the spawned process.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

Windows Process Creation: Suspicious Network Configuration and Discovery Commands

Pivot detection · T1016 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-network-configuration-and-discovery-commands-a29c1813

title: "Windows Process Creation: Suspicious Network Configuration and Discovery Commands"
id: 5fe0e669-bcc3-4526-abf9-c36847eb82bf
status: test
description: This rule flags Windows process creation events where the command line matches common network configuration and discovery utilities (such as ipconfig /all, netsh interface show interface, arp -a, nbtstat -n, net config, and route print). Attackers often run these commands to collect local and remote network details for positioning, connectivity testing, and subsequent actions. The detection relies on process_creation telemetry, specifically the CommandLine field of the spawned process.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-1---system-network-configuration-discovery-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_network_command.yml
author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Huntrule Team
date: 2021-12-07
modified: 2025-10-19
tags:
  - attack.discovery
  - attack.t1016
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re:
      - ipconfig\s+/all
      - netsh\s+interface show interface
      - arp\s+-a
      - nbtstat\s+-n
      - net\s+config
      - route\s+print
  condition: selection
falsepositives:
  - Administrator, hotline ask to user
level: low
license: DRL-1.1
related:
  - id: a29c1813-ab1f-4dde-b489-330b952e91ae
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL