Remote System Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag p...
BY SOURCE
PROCEDURES (23)
Auto-extracted: 6 detections for process creation monitoring
Auto-extracted: 4 detections for script block
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for network connection monitoring
Auto-extracted: 3 detections for general monitoring
Auto-extracted: 3 detections for script execution monitoring
Auto-extracted: 3 detections for wmi
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for kerbero
Auto-extracted: 2 detections for remote
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for dns