Host Discovery Commands

Hypothesis and description

When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally.

Because these commands are built in, they may be run frequently by power users or even by normal users. Thus, an analytic looking at this information should have well-defined white- or blacklists, and should consider looking at an anomaly detection approach, so that this information can be learned dynamically.

Within the built-in Windows Commands:

- hostname

- ipconfig

- net

- quser

- qwinsta

- sc with flags query, queryex, qc

- systeminfo

- tasklist

- dsquery

- whoami

Note dsquery is only pre-existing on Windows servers.

Platforms: Windows, Linux, macOS
Domain: Host
Subtypes: Process
Submitted: 2016-03-24
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1087 Account DiscoveryT1087.001, T1087.002	Discovery	Moderate
T1069 Permission Groups DiscoveryT1069.001, T1069.002	Discovery	Moderate
T1016 System Network Configuration Discovery	Discovery	Moderate
T1082 System Information Discovery	Discovery	Moderate
T1033 System Owner/User Discovery	Discovery	Moderate
T1057 Process Discovery	Discovery	Moderate
T1007 System Service Discovery	Discovery	Moderate

7 techniques, 11 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

To be effective in deciphering malicious and benign activity, the full command line is essential. Similarly, having information about the parent process can help with making decisions and tuning to an environment.

process = search Process:Create
info_command = filter process where (
 exe == "hostname.exe" or
 exe == "ipconfig.exe" or
 exe == "net.exe" or
 exe == "quser.exe" or
 exe == "qwinsta.exe" or
 exe == "sc" and (command_line match " query" or command_line match " qc")) or
 exe == "systeminfo.exe" or
 exe == "tasklist.exe" or
 exe == "whoami.exe"
)
output info_command

SplunkData model: Sysmon native

Splunk version of the above pseudocode search.

index=__your_sysmon_index__ EventCode=1 (Image="C:\\Windows\\*\\hostname.exe" OR Image="C:\\Windows\\*\\ipconfig.exe" OR Image="C:\\Windows\\*\\net.exe" OR Image="C:\\Windows\\*\\quser.exe" OR Image="C:\\Windows\\*\\qwinsta.exe" OR (Image="C:\\Windows\\*\\sc.exe" AND (CommandLine="* query *" OR CommandLine="* qc *")) OR Image="C:\\Windows\\*\\systeminfo.exe" OR Image="C:\\Windows\\*\\tasklist.exe" OR Image="C:\\Windows\\*\\whoami.exe")|stats values(Image) as "Images" values(CommandLine) as "Command Lines" by ComputerName

EQLData model: EQL native

EQL version of the above pseudocode search.

process where subtype.create and
  (process_name == "hostname.exe" or process_name == "ipconfig.exe" or process_name == "net.exe" or process_name == "quser.exe" process_name == "qwinsta.exe" or process_name == "systeminfo.exe" or process_name == "tasklist.exe" or process_name == "whoami.exe" or (process_name == "sc.exe" and (command_line == "* query *" or command_line == "* qc *")))

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 (image in ["*\hostname.exe", "*\ipconfig.exe", "*\net.exe", "*\quser.exe", "*\qwinsta.exe", "*\systeminfo.exe", "*\tasklist.exe", "*\whoami.exe"] OR (image="*\sc.exe" command IN ["* query *", "* qc *"))

Across MITRE's defensive frameworks

Linked through the 7 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

31 more in the full list

View CAR-2016-03-001 on car.mitre.org