MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Discovery/ T1018

T1018Remote System Discovery

T1018 — Remote System Discovery is a MITRE ATT&CK technique in the Discovery tactic. Clankerusecase tracks 25 detection use cases covering it and 2 threat-intel articles citing it.

Discovery

View on the matrix → Filter Detection Library MITRE official spec ↗

25Use cases

2Articles

0Sub-techniques

1Tactic

Use cases covering this technique (25)

Cisco IOS XE Remote Access Probe Burst ESCU actions · hunting P Domain Controller Discovery with Nltest ESCU actions · alerting P Domain Controller Discovery with Wmic ESCU actions · hunting P GetAdComputer with PowerShell ESCU actions · hunting P GetAdComputer with PowerShell Script Block ESCU actions · hunting P GetDomainComputer with PowerShell ESCU actions · alerting P GetDomainComputer with PowerShell Script Block ESCU actions · alerting P GetDomainController with PowerShell ESCU actions · hunting P GetDomainController with PowerShell Script Block ESCU actions · alerting P GetWmiObject Ds Computer with PowerShell ESCU actions · hunting P GetWmiObject Ds Computer with PowerShell Script Block ESCU actions · alerting P Remote System Discovery with Adsisearcher ESCU actions · alerting P Remote System Discovery with Dsquery ESCU actions · hunting P Remote System Discovery with Wmic ESCU actions · alerting P Windows AdFind Exe ESCU actions · alerting P Windows Get-AdComputer Unconstrained Delegation Discovery ESCU actions · alerting P Windows Netspy Network Scanner Execution ESCU actions · hunting P Windows PowerView Constrained Delegation Discovery ESCU actions · alerting P Windows PowerView Unconstrained Delegation Discovery ESCU actions · alerting P Windows PsTools Recon Usage ESCU actions · hunting P Cisco Secure Firewall - Blocked Connection ESCU actions · hunting P Cisco Secure Firewall - Repeated Blocked Connections ESCU actions · hunting P Remote System Discovery with Net ESCU actions · hunting P [LLM] Container-to-container horizontal scan — Dero miner self-propagation Bespoke actions · alerting DSPDDCS [LLM] PAN-OS firewall service account LDAP enumeration of DomainDnsZones Bespoke actions · hunting DSPDD

Articles citing this technique (2)

crit What’s in the container? Analyzing vulnerabilities, risks and protection with Kaspersky Container Security and the KIRA AI assistant art-180

crit Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution art-325