Uncommon IP Configuration Listing via ipconfig.exe
Synopsis
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Hour
Required Data
XDR Agent
ATT&CK Tactic
Discovery (TA0007)
ATT&CK Technique
System Network Configuration Discovery (T1016)
Severity
Low
Description
The 'ipconfig' command is used to display TCP/IP network configuration information and refresh the Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Adversaries may use the command to discover network configuration details.
Attacker's Goals
Attackers can use the ipconfig command to discover network configuration details.
Investigative actions
Check whether the initiator process is benign or normal for the host and/or user performing it.
Check whether additional discovery commands were executed from the same process.
Was this helpful?