S0104: netstat
Analyst context for executives and security teams
netstat is a normal operating-system utility for viewing active network connections, listening ports, and network statistics. Its security importance is not that the tool is malicious, but that adversaries and intrusion operators can use built-in utilities like this to understand what a compromised system can reach. For leaders, this is a coverage question: can the organization distinguish legitimate administration from suspicious discovery activity when the tool used is already trusted and commonly present?
Executive priority
Prioritize netstat as part of living-off-the-land discovery coverage rather than as a standalone threat. The relationship context links this tool to multiple campaigns and groups and to ATT&CK technique T1049, System Network Connections Discovery. That makes it relevant to incident scoping, lateral-movement readiness, critical infrastructure resilience, and audit evidence showing that discovery behaviors are monitored even when no malware-specific indicator exists.
Technical view
ATT&CK provides no official detection text and no platform list for the netstat tool object, so SOC and IR teams should validate coverage through the related T1049 behavior: attempts to list network connections to or from a compromised system. Detection engineering should focus on command/process execution context, parent process, user identity, host role, timing, and correlation with other discovery or remote-access activity. Because netstat is a legitimate utility, alerts should not be based on execution alone; they should be tuned around unusual users, unusual hosts, suspicious parent processes, repeated enumeration, or occurrence during an incident sequence.
Likely telemetry
- Process creation and command-line logging for netstat execution where available
- User, host, and session context tied to the process event
- Parent and child process relationships around the utility invocation
- Endpoint detection and response telemetry for discovery sequences
- Network connection state or listening-port evidence from host or network sensors
Detection direction
- Confirm whether netstat execution is logged with command-line detail and parent process context; without this, detection is likely limited to weak or retrospective evidence.
- Baseline legitimate administrative usage by server role, administrator group, and maintenance window to reduce false positives.
- Correlate netstat activity with related T1049-style discovery, especially when it appears after initial access or on systems not normally used for administration.
- Treat the relationship to multiple campaigns and groups as threat-intelligence context for prioritization, not as proof that any local netstat event is malicious.
- Look for blind spots where built-in tools are allowed but not logged, where EDR command-line capture is disabled, or where privileged interactive sessions are not attributable to a named user.
Mitigation priorities
- Improve visibility first: ensure endpoint and SIEM logging can capture process execution, command-line arguments, user context, and parent process information.
- Harden administrative access so use of diagnostic utilities is attributable, least-privileged, and limited to approved operators or management paths.
- Build detection content around discovery behavior sequences rather than blocking netstat outright, since it is a legitimate operating-system utility.
- Use incident response playbooks to treat suspicious netstat use as a scoping trigger: identify the user, session origin, reachable services observed, and nearby discovery actions.
- For regulated, critical infrastructure, cloud, or OT-adjacent environments, retain evidence that network discovery activity is monitored and reviewed as part of resilience and compliance readiness.
Analyst notes and limits
The ATT&CK object is a tool entry with a short official description and no official detection guidance. The strongest decision value comes from its relationship to T1049 System Network Connections Discovery and from the number of campaigns and groups documented as using it. This supports prioritizing telemetry and behavioral correlation, but not making netstat execution alone a high-confidence alert.
Platforms and tactics are not specified on the netstat tool object, and ATT&CK provides no official detection text for this entry. The related technique lists platforms, but local applicability depends on whether netstat or equivalent utilities exist and are logged in the environment. The supplied relationships show reported use, not current activity or guaranteed relevance to any specific organization.
netstat
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1049 | System Network Connections Discovery | netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.CitationTechNet Netstat |
Groups, software, and campaigns
G1001: HEXANE
HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.[1][2][3][4]
G0004: Ke3chang
G0010: Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
G0071: Orangeworm
Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.[1] Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.[2]
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
G0049: OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]
G0027: Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
G1022: ToddyCat
G0018: admin@338
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors. [1]
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
G1023: APT5
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
C0026: C0026
C0026 was a campaign identified in September 2022 that included the selective distribution of KOPILUWAK and QUIETCANARY malware to previous ANDROMEDA malware victims in Ukraine through re-registered ANDROMEDA C2 domains. Several tools and tactics used during C0026 were consistent with historic Turla operations.[1]
C0007: FunnyDream
FunnyDream was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Security researchers linked the FunnyDream campaign to possible Chinese-speaking threat actors through the use of the Chinoxy backdoor and noted infrastructure overlap with the TAG-16 threat group.[1][2][3]
C0063: 2025 Poland Wiper Attacks
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.4 | Current bundle | 531e9f5e44f2… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
TechNet Netstat
Microsoft. (n.d.). Netstat. Retrieved April 17, 2016.
Open source URL -
[2]
mitre-attack S0104Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.