Internet Connection Discovery (T1016.001) is a sub-technique of System Network Configuration Discovery. Adversaries check for internet connectivity on compromised systems. MITRE lists Windows, Linux, macOS and ESXi.
How attackers use it
MITRE gives several methods: Ping, tracert, GET requests to websites, or an initial speed test to confirm bandwidth. The results tell the adversary whether the system can reach its C2 servers before it tries. They may also reveal routes, redirectors and proxy servers.
How to detect it
MITRE's analytic covers each platform:
- Windows: utilities such as ping, tracert and Test-NetConnection, or scripts, that test connectivity to external addresses and domains.
- Linux: ping, traceroute, or curl and wget against public addresses.
- macOS: ping, traceroute or other network tools to external destinations, possibly with scutil or system_profiler.
- ESXi: ping, vmkping or curl from a shell or automation job.
These commands are common, so look at who runs them. A connectivity check from a server that never initiates traffic, or from a process spawned by an office application, is notable. On ESXi, any outbound connectivity test from a host that should have no internet access is worth a ticket.
How to reduce the risk
MITRE lists no mitigations. Restrictive egress helps indirectly. If servers cannot reach the internet, a failed check ends the intrusion early, and the attempt shows up in your firewall logs as a blocked connection.
Tuning the detection
Many programs check connectivity. Browsers, update clients and monitoring tools do it constantly. Rely on process and parent. A connectivity test from a background process spawned by a document viewer, or from a server that never calls out, is the interesting case.
A second approach is to watch the endpoints used for checks. Tests often target well-known public addresses and domains. If a server contacts one of those and nothing else in its history does, mark it for review.
Quick check
Why check connectivity before calling home?
It tells the adversary whether the host can reach C2 servers, and may reveal routes, redirectors and proxies.
