<jupyter_start><jupyter_text>T1018 - Remote System DiscoveryAdversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as  [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also use local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) in order to discover the hostname to IP address mappings of remote systems. Specific to macOS, the bonjour protocol exists to discover additional Mac-based systems within the same broadcast domain.Within IaaS (Infrastructure as a Service) environments, remote systems include instances and virtual machines in various states, including the running or stopped state. Cloud providers have created methods to serve information about remote systems, such as APIs and CLIs. For example, AWS provides a DescribeInstances API within the Amazon EC2 API and a describe-instances command within the AWS CLI that can return information about all instances within an account.(Citation: Amazon Describe Instances API)(Citation: Amazon Describe Instances CLI) Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project, and Azure's CLI az vm list lists details of virtual machines.(Citation: Google Compute Instances)(Citation: Azure VM List)  Atomic Tests<jupyter_code>#Import the Module before running the tests.
# Checkout Jupyter Notebook at https://github.com/cyb3rbuff/TheAtomicPlaybook to run PS scripts.
Import-Module /Users/0x6c/AtomicRedTeam/atomics/invoke-atomicredteam/Invoke-AtomicRedTeam.psd1 - Force<jupyter_output><empty_output><jupyter_text>Atomic Test 1 - Remote System Discovery - netIdentify remote systems with net.exe.Upon successful execution, cmd.exe will execute `net.exe view` and display results of local systems on the network that have file and print sharing enabled.**Supported Platforms:** windows Attack Commands: Run with `command_prompt````command_promptnet view /domainnet view```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 1<jupyter_output><empty_output><jupyter_text>Atomic Test 2 - Remote System Discovery - net group Domain ComputersIdentify remote systems with net.exe querying the Active Directory Domain Computers group.Upon successful execution, cmd.exe will execute cmd.exe against Active Directory to list the "Domain Computers" group. Output will be via stdout.**Supported Platforms:** windows Attack Commands: Run with `command_prompt````command_promptnet group "Domain Computers" /domain```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 2<jupyter_output><empty_output><jupyter_text>Atomic Test 3 - Remote System Discovery - nltestIdentify domain controllers for specified domain.Upon successful execution, cmd.exe will execute nltest.exe against a target domain to retrieve a list of domain controllers. Output will be via stdout.**Supported Platforms:** windows Attack Commands: Run with `command_prompt````command_promptnltest.exe /dclist:domain.local```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 3<jupyter_output><empty_output><jupyter_text>Atomic Test 4 - Remote System Discovery - ping sweepIdentify remote systems via ping sweep.Upon successful execution, cmd.exe will perform a for loop against the 192.168.1.1/24 network. Output will be via stdout.**Supported Platforms:** windows Attack Commands: Run with `command_prompt````command_promptfor /l %i in (1,1,254) do ping -n 1 -w 100 192.168.1.%i```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 4<jupyter_output><empty_output><jupyter_text>Atomic Test 5 - Remote System Discovery - arpIdentify remote systems via arp. Upon successful execution, cmd.exe will execute arp to list out the arp cache. Output will be via stdout.**Supported Platforms:** windows Attack Commands: Run with `command_prompt````command_promptarp -a```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 5<jupyter_output><empty_output><jupyter_text>Atomic Test 6 - Remote System Discovery - arp nixIdentify remote systems via arp.Upon successful execution, sh will execute arp to list out the arp cache. Output will be via stdout.**Supported Platforms:** linux, macos Dependencies:  Run with `sh`! Description: Check if arp command exists on the machine Check Prereq Commands:```shif [ -x "$(command -v arp)" ]; then exit 0; else exit 1; fi;``` Get Prereq Commands:```shecho "Install arp on the machine."; exit 1;```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 6 -GetPreReqs<jupyter_output><empty_output><jupyter_text>Attack Commands: Run with `sh````sharp -a | grep -v '^?'```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 6<jupyter_output><empty_output><jupyter_text>Atomic Test 7 - Remote System Discovery - sweepIdentify remote systems via ping sweep.Upon successful execution, sh will perform a ping sweep on the 192.168.1.1/24 and echo via stdout if an IP is active.**Supported Platforms:** linux, macos Attack Commands: Run with `sh````shfor ip in $(seq 1 254); do ping -c 1 192.168.1.$ip; [ $? -eq 0 ] && echo "192.168.1.$ip UP" || : ; done```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 7<jupyter_output><empty_output><jupyter_text>Atomic Test 8 - Remote System Discovery - nslookupPowershell script that runs nslookup on cmd.exe against the local /24 network of the first network adaptor listed in ipconfig.Upon successful execution, powershell will identify the ip range (via ipconfig) and perform a for loop and execute nslookup against that IP range. Output will be via stdout.**Supported Platforms:** windowsElevation Required (e.g. root or admin) Attack Commands: Run with `powershell````powershell$localip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1]$pieces = $localip.split(".")$firstOctet = $pieces[0]$secondOctet = $pieces[1]$thirdOctet = $pieces[2]foreach ($ip in 1..255 | % { "$firstOctet.$secondOctet.$thirdOctet.$_" } ) {cmd.exe /c nslookup $ip}```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 8<jupyter_output><empty_output><jupyter_text>Atomic Test 9 - Remote System Discovery - adidnsdumpThis tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networksPython 3 and adidnsdump must be installed, use the get_prereq_command's to meet the prerequisites for this test.Successful execution of this test will list dns zones in the terminal.**Supported Platforms:** windowsElevation Required (e.g. root or admin) Dependencies:  Run with `powershell`! Description: Computer must have python 3 installed Check Prereq Commands:```powershellif (python --version) {exit 0} else {exit 1}``` Get Prereq Commands:```powershellecho "Python 3 must be installed manually"``` Description: Computer must have pip installed Check Prereq Commands:```powershellif (pip3 -V) {exit 0} else {exit 1}``` Get Prereq Commands:```powershellecho "PIP must be installed manually"``` Description: adidnsdump must be installed and part of PATH Check Prereq Commands:```powershellif (cmd /c adidnsdump -h) {exit 0} else {exit 1}``` Get Prereq Commands:```powershellpip3 install adidnsdump```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 9 -GetPreReqs<jupyter_output><empty_output><jupyter_text>Attack Commands: Run with `command_prompt````command_promptadidnsdump -u domain\user -p password --print-zones 192.168.1.1```<jupyter_code>Invoke-AtomicTest T1018 -TestNumbers 9<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.08791208791208792, 'fraction_numerical': 0.022762951334379906, 'mean_word_length': 6.02020202020202, 'pattern_counts': {'":': 0, '<': 49, '<?xml version=': 0, '>': 49, 'https://': 3, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 3, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '12', 'dir': 'jupyter-structured-clean-dedup', 'id': '12615', 'license': 'MIT', 'n_tokens_mistral': 2380, 'n_tokens_neox': 2107, 'n_words': 851, 'path': 'playbook/tactics/discovery/T1018.ipynb', 'repo_name': 'haresudhan/The-AtomicPlaybook', 'size': '7644'}