T1049

System Network Connections Discovery

ESXi · IaaS · Linux · macOS · Network Devices · Windowsnothing on this site yetT1049 on attack.mitre.org

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of System Network Connections Discovery Across Platforms

Detects usage of commands or binaries (e.g., netstat, PowerShell Get-NetTCPConnection) and WMI or API calls to enumerate local or remote network connections.
Detects use of netstat, ss, lsof, or custom shell scripts to list current network connections. Often paired with privilege escalation or staging.
Detects shell-based enumeration of active connections using `netstat`, `lsof -i`, or AppleScript-based system discovery.
Detects shell or API usage of `esxcli network ip connection list` or `netstat` to enumerate ESXi host connections.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.