Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1016.001sub-technique of T1016 System Network Configuration Discovery

Internet Connection Discovery

Windows · Linux · macOS · ESXinothing on this site yetT1016.001 on attack.mitre.org

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, `tracert`, and GET requests to websites, or performing initial speed testing to confirm bandwidth.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Behavioral Detection of Internet Connection Discovery

  • Execution of utilities (e.g., ping, tracert, Test-NetConnection) or scripted methods to test Internet connectivity by interacting with external IPs/domains.
  • Execution of ping, traceroute, or curl/wget against public IPs/domains to verify Internet reachability.
  • Execution of ping, traceroute, or network utility tools to external destinations; may include `scutil` or system_profiler.
  • Execution of `ping`, `vmkping`, or `curl` from shell or through automation jobs/scripts to verify Internet egress.

the rest of T1016

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.