Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1018

Remote System Discovery

ESXi · Linux · macOS · Network Devices · Windowsnothing on this site yetT1018 on attack.mitre.org

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, `net view` using Net, or, on ESXi servers, `esxcli network diag ping`.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Remote System Enumeration Behavior

  • Execution of network enumeration utilities (e.g., net.exe, ping.exe, tracert.exe) in short succession, often chained with lateral movement tools or system enumeration commands.
  • Use of bash scripts or interactive shells to issue sequential ping, arp, or traceroute commands to map remote hosts.
  • Execution of built-in or AppleScript-based system enumeration via `arp`, `netstat`, `ping`, and discovery of `/etc/hosts` contents.
  • ESXi shell or SSH access issuing `esxcli network diag ping` or viewing routing tables to identify connected hosts.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.