Internet Connection Discovery
Subtechnique · ATTACK:enterprise:T1016.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1016.001",
"title": "Internet Connection Discovery",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1016/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--132d5b37-aac5-4378-a8dc-3127b18a73dc",
"external_id": "T1016.001",
"domain": "enterprise",
"created": "2021-03-17T15:28:10.689Z",
"modified": "2025-10-24T17:48:26.017Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0597 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--001ecf24-8276-40d2-ba05-2d20e5c53ec9
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0284 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04919717-aa68-4192-b095-c1607f8f6ead
Security Intelligence More Eggs Aug 2019ATTACK:enterprise:S0691 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f70aa6c-c7a0-4628-b073-10fd1c576d45
Microsoft NICKEL December 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a764532-6758-4a82-90e4-eb53d1ac9c16
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31f93f78-799b-4f65-892c-da3aba4bb32d
DFIR Phosphorus November 2021ATTACK:enterprise:S1049 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35c568aa-29af-4879-bdee-4f6a1f54ff22
Mandiant UNC3890 Aug 2022ATTACK:enterprise:S1107 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--438d20c5-9a71-43c8-b418-ca6360a515ff
NKAbuse SLATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--486e3108-33ad-4506-8031-7215acd5ff69
Kaspersky Lyceum October 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4aec046b-4d53-44ea-97d0-e5a57290fb1e
Kaspersky QakBot September 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c747463-f1e0-40fd-a3ed-dc01bc112651
Mandiant APT29 Eye Spy Email Nov 22ATTACK:enterprise:S0686 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b4a0fe7-5fcc-4f74-8914-2d4bc25b9d02
Microsoft Actinium February 2022ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fc69974-db3b-4475-b37b-07c4731b1a6f
Symantec Shuckworm January 2022 · SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63106a66-1408-4a15-b945-072f5e3ae2ff
Lunghi Iron Tiger LinuxATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71e68523-de1b-4368-b6ae-4800466a92b1
Zscaler Havoc FEB 2023ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86c55cd3-efb5-4bd3-9958-a5af1f1b0679
Cisco Operation Layover September 2021ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88231281-0f0d-4655-b083-a90faf9056fe
FoxIT Wocao December 2019ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d557d2a-6d39-491f-bafc-c256910a59a2
Cisco LotusBlossom 2025ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d5fe299-0c6c-4719-8125-d9576ddbff32
Secureworks DarkTortilla Aug 2022ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a06f76b9-1920-4660-a2f3-cc0db8d585c0
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4a03850-ad3e-4599-af58-5aa67c63fb93
Mandiant FIN13 Aug 2022ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9edded2-4f07-431c-bdc1-e7ba489dd253
McAfee Sharpshooter December 2018ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baaa6228-daa9-45e9-884e-42add3851843
Rapid7 HAFNIUM Mar 2021ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdbb0dc8-23e3-4dad-a2a8-52240353f587
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:T1016.001 → subtechnique-of → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5c24fec-a81a-4dfb-8d41-2199b76038a5
ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0aaa143-5c5f-4c58-8ace-d05b037bf4b6
ESET ComRAT May 2020ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f761e8f4-932d-4809-acac-2c61b6e3aa3d
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd135724-b4b3-470a-95c6-43191f99dcb6
Bitdefender Sardonic Aug 2021