// MITRE ATT&CK
T1016.001 · Internet Connection Discovery
Sub-técnica de T1016 · System Network Configuration Discovery.
Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites, or performing initial s...
¿Cómo detectarlo y mitigarlo?
La detección de Internet Connection Discovery parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1033
System Owner/User Discovery T1613
Container and Resource Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1652
Device Driver Discovery T1087.002
Domain Account T1087.001
Local Account
System Owner/User Discovery T1613
Container and Resource Discovery T1069
Permission Groups Discovery T1069.003
Cloud Groups T1615
Group Policy Discovery T1652
Device Driver Discovery T1087.002
Domain Account T1087.001
Local Account
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.