Discovery of Internet Capabilities via Built-in Tools

Last updated 13 days ago on 2026-02-19

Created 3 years ago on 2023-07-12

About

Identifies the use of built-in tools attackers can use to check for Internet connectivity on compromised systems. These results may be used to determine communication capabilities with C2 servers, or to identify routes, redirectors, and proxy servers.

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: DiscoveryRule Type: BBRData Source: Elastic DefendLanguage: kuery

Severity

low

Risk Score

MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ System Network Configuration Discovery (T1016)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-endpoint.events.*
Related Integrations: endpoint(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗host.os.type:windows and event.category:process and event.type:start and 
process.name.caseless:("ping.exe" or "tracert.exe" or "pathping.exe") and
not process.args:("127.0.0.1" or "0.0.0.0" or "localhost" or "::1" or 192.168.*) and
process.command_line:*.*

Install detection rules in Elastic Security

Detect Discovery of Internet Capabilities via Built-in Tools in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).