TACTIC: DISCOVERY
Remote System Discovery (T1018): Real Cases
MITRE Definition ↗ Adversaries search for other systems on an internal network to identify lateral movement candidates.
Key Facts
Technique ID
T1018
Discovery
Mapped Cases
1
Primary sources
Related Laws
1
Criminal statutes
- ATT&CK Technique Identifier: T1018.
- Tactical Phase: Discovery.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
Volt Typhoon Critical Infrastructure Pre-Positioning
alleged 2023-05-24
State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
Primary Source Evidence Excerpt: CISA Advisory AA24-038A ¶ 22
"Adversaries executed ping sweeps and 'net group "Domain Computers" /domain' to identify neighboring workstation hostnames."
Federal Law Enforcement Action / FISA Court Authorized Operations · CISA-AA24-038A
View full case dossier →