Detect execution of built-in network configuration utilities

Siemphony@siemphonylowT1016unverified

MITRE's Windows analytic for this strategy is the execution of the built-in addressing and routing tools, so this rule matches the handful whose only purpose is reporting network configuration — ipconfig, arp, route, nbtstat and getmac — on a single process-creation event. It is deliberately one field: the extra conditions MITRE's knobs point at (ParentProcess chains, UserContext, clustering several enumeration commands inside a TimeWindow) are either correlations Sigma cannot express or environment-specific allowlists, so they are left to tuning instead of being baked in. Two limits to know before deploying: the match is on the image path, so a copy of ipconfig.exe renamed to something innocuous is missed, and netsh- and PowerShell-based enumeration such as Get-NetIPConfiguration is not covered here at all even though the strategy also lists the PowerShell 4103/4104 source. The logic is written in the Sysmon EventID 1 vocabulary the brief names for this category; if the same category is fed from Security 4688 instead, that channel needs Audit Process Creation enabled and its own field mapping first. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0195, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\ipconfig.exe" or FolderPath endswith "\\arp.exe" or FolderPath endswith "\\route.exe" or FolderPath endswith "\\nbtstat.exe" or FolderPath endswith "\\getmac.exe")

Splunk · SPL

Run this as a search.

index=* (Image="*\\ipconfig.exe" OR Image="*\\arp.exe" OR Image="*\\route.exe" OR Image="*\\nbtstat.exe" OR Image="*\\getmac.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\ipconfig.exe" OR TO_LOWER(process.executable) LIKE "*\\\\arp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\route.exe" OR TO_LOWER(process.executable) LIKE "*\\\\nbtstat.exe" OR TO_LOWER(process.executable) LIKE "*\\\\getmac.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\ipconfig\.exe$|\\arp\.exe$|\\route\.exe$|\\nbtstat\.exe$|\\getmac\.exe$)</field>    <description>Detect execution of built-in network configuration utilities</description>    <mitre>      <id>T1016</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6663c02e-dcdd-4a44-9e72-b91b02e9e6d4

ATT&CKT1016

T1016System Network Configuration Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

The rule is Detect execution of built-in network configuration utilities. It fires when any of five Windows binaries starts: ipconfig.exe, arp.exe, route.exe, nbtstat.exe, getmac.exe. MITRE's Windows analytic AN0559 describes execution of built-in tools, netsh, or PowerShell/WMI queries to enumerate IP, MAC, interface status or routing configuration. This rule implements the first clause of that sentence and nothing else — netsh was left out for noise, and the PowerShell leg (Get-NetIPConfiguration, Get-NetAdapter, Get-NetRoute) is not covered at all, even though the strategy carries a second log source for it. On a current estate those cmdlets are the dominant form, so treat this as partial coverage, not coverage.

02 · Telemetry you need

One log source, copied verbatim from the brief: category: process_creation, product: windows. The logic is written in the Sysmon EventID 1 vocabulary, which is where the Image field lives. If your pipeline feeds this category from Security 4688 instead, the binary path arrives as NewProcessName, so the rule needs a field mapping before it will match anything — and 4688 itself requires the Audit Process Creation subcategory, which is off in a default install and in the MS and CIS baselines alike.

03 · How the logic works

There is a single selection block and the condition is just selection. It tests Image|endswith against the five paths, each written with a leading backslash ('\ipconfig.exe') so the match anchors on a path separator rather than on any filename ending in those characters. There is no CommandLine gate. Two consequences follow directly. First, a renamed copy of ipconfig.exe evades the rule outright; Sysmon EventID 1 does carry OriginalFileName, which survives renaming, so this gap is closeable rather than inherent. Second, route.exe ADD and arp.exe -s write the routing table and ARP cache — a configuration change, not discovery — and raise an alert identical to route print or arp -a. A hit is also not by itself evidence of T1016: arp -a and nbtstat map just as naturally to T1018 and T1049, and the attribution follows the arguments, not the binary.

04 · Common false positives

Very. Logon scripts, imaging tasks and inventory agents calling ipconfig /all or getmac at every boot are the highest-volume match by a wide margin, which is why the rule is scored low rather than medium. Behind that: helpdesk troubleshooting (ipconfig /release, /renew, arp -a, route print are the first four commands typed at any connectivity complaint), VPN and NAC agents shelling out to route.exe for split-tunnel routes once per connection, and legacy print and file-share scripts still resolving NetBIOS names with nbtstat.

05 · Detection maturity

tier_1: Lowest tier. This rule was authored from a MITRE prose analytic and has never been executed against a single log line — no true positive, no false positive rate, no field validation beyond the schema. It is a scaffold to run in a hunt window and measure, and it earns a higher tier only after real data moves it.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's AN0559 names three knobs, and all three are left to you rather than baked in. ParentProcess filters known-good CLI chains; on a managed estate, excluding agent parents removes most of the volume. UserContext narrows to non-admin or unexpected accounts. TimeWindow clusters several enumeration commands together — that one Sigma cannot express, so it belongs in your SIEM's correlation layer, not in this file. The five binaries are the pipeline's own selection, not MITRE's list. If you want the noisy pair back under control, gate route.exe and arp.exe on a read verb before excluding them entirely.

Declared by the author

Logon scripts, imaging tasks and inventory agents that record a host's addressing by calling ipconfig /all or getmac at every boot or logon. On a managed estate this is the highest-volume match by a wide margin and is the reason the rule is scored low rather than medium.
Helpdesk and desktop-support troubleshooting, where ipconfig /release, ipconfig /renew, arp -a and route print are the first commands typed at any connectivity complaint.
VPN, NAC and endpoint agents that shell out to route.exe to add or remove split-tunnel routes and to ipconfig /flushdns after a tunnel comes up, once per connection per host.
Legacy print, file-share and antivirus maintenance scripts that still call nbtstat to resolve NetBIOS names before touching a share.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1016, evaluated against their process_creation events.

Share this rule

/u/siemphony/6663c02e-dcdd-4a44-9e72-b91b02e9e6d4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect execution of built-in network configuration utilities

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it