T1016.001 Internet Connection Discovery
sub-techniqueEnterpriseAdversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth. Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them. The results may also be used to identify routes, redirectors, and proxy servers.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
sub-technique of
The broader entity this sits under.
detected by (4)
Data components that detect this.
groups (11)
Threat groups associated with this.
software (13)
Malware and tools associated with this.
campaigns (2)
Campaigns that use this.
source
Where this definition is published.