PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
TACTIC: DISCOVERY

System Network Configuration Discovery (T1016): Real Cases

MITRE Definition ↗
Adversaries search for network settings and IP configurations to understand internal network routing.

Key Facts

Technique ID
T1016
Discovery
Mapped Cases
1
Primary sources
Related Laws
1
Criminal statutes
  • ATT&CK Technique Identifier: T1016.
  • Tactical Phase: Discovery.
  • Substantiated in 1 primary court prosecution and advisory cases.
  • Linked records cite judicial dockets, plea agreements, or federal advisories.

Verified Evidentiary Case Records (1)

Volt Typhoon Critical Infrastructure Pre-Positioning

alleged 2023-05-24

State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.

Primary Source Evidence Excerpt: CISA Advisory AA24-038A ¶ 18
"Volt Typhoon operators ran 'ipconfig /all' and 'netsh interface portproxy show all' to document network interface routing."
Source: CISA Advisory AA24-038A ↗
Federal Law Enforcement Action / FISA Court Authorized Operations · CISA-AA24-038A View full case dossier →

Commonly Charged Criminal Statutes

18 U.S.C. § 1029

Fraud and Related Activity in Connection with Access Devices

Prohibits knowingly producing, using, or trafficking in counterfeit access devices or unauthorized access devices including stolen credit card numbers.