Remote System Discovery

What is Remote System Discovery?

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifiers on a network that may be used for lateral movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or net view to gain information about remote systems. After compromising an initial host, attackers systematically enumerate the internal network to identify additional targets, understand network topology, and prioritize hosts for further compromise. Active Directory queries provide a comprehensive listing of all domain-joined systems including their names, IP addresses, operating systems, and physical locations. Passive discovery techniques including analysis of ARP caches, broadcast traffic monitoring, and DNS zone transfers allow attackers to map the network without generating the scanning traffic that triggers network intrusion detection systems.

“Remote System Discovery is documented as technique T1018 in the MITRE ATT&CK knowledge base under the Discovery tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Remote System Discovery activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for execution of network discovery commands including ping sweep scripts, net view, nbtstat -A, and arp -a from workstations and servers that do not have administrative or network management roles.

2. 2

   Alert on Active Directory LDAP queries retrieving computer objects, particularly queries requesting all computer accounts or filtering for specific operating systems that attackers target for exploitation.

3. 3

   Detect ICMP sweep activity through NetFlow analysis, alerting on hosts generating ICMP echo requests to sequential IP ranges that extend beyond their normal communication partners within the environment.

4. 4

   Monitor DNS queries for reverse lookups against large IP ranges, which attackers use to enumerate hostnames associated with discovered IP addresses as a passive alternative to active scanning.

5. 5

   Track ARP cache reads from automation tools and scripts, as commands like arp -a provide a ready-made list of recently contacted hosts on the local network segment without generating additional network traffic.

Example Alerts

These realistic alert examples show what Remote System Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Remote System Discovery?

SOC analysts detect Remote System Discovery (T1018) by monitoring SIEM, Firewall telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for execution of network discovery commands including ping sweep scripts, net view, nbtstat -a, and arp -a from workstations and servers that . SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Remote System Discovery?

Remote System Discovery can be detected using SIEM, Firewall platforms. SIEM tools are particularly effective for this technique because they provide visibility into the discovery phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Remote System Discovery in real-world attacks?

Remote System Discovery is a well-documented MITRE ATT&CK technique in the Discovery tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Remote System Discovery scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Remote System Discovery for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Discovery techniques like Remote System Discovery. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.