Remote System Discovery
Find other hosts on the network.
§ Where this technique fits
T1018 is catalogued under the Discovery tactic of the offensive-security kill-chain. It appears in 3 approved dossiers in the registry, typically at step 1.3 on average.
Authoritative reference: attack.mitre.org/techniques/T1018/.
§ Dossiers chaining this technique
- step 1 / 8
No creds → Domain Admin via LLMNR poisoning and NTLM relay
Unauthenticated attacker on the LAN poisons name resolution, relays the captured NetNTLMv2 to a host with SMB signing disabled, then escalates to Domain Admin.
- step 1 / 5
ZeroLogon (CVE-2020-1472) → Domain takeover
Unauthenticated attacker abuses the Netlogon AES-CFB8 flaw to reset a DC's machine account password to empty, dumps secrets, and restores the original password.
- step 2 / 5
DNS tunnel exfiltration in restricted egress
Outbound web is filtered, but DNS still resolves to the corporate forwarder. Use iodine / dnscat2 to tunnel a shell + exfil over DNS queries to an attacker-controlled authoritative server.
§ What commonly comes next
- 01DNS Tunneling Exfil (iodine / dnscat2)seen 1×DNS-TUNNEL-EXFIL · Exfiltration
- 02LLMNR/NBT-NS Poisoning and SMB Relayseen 1×T1557.001 · Credential Access
- 03ZeroLogon (CVE-2020-1472)seen 1×AD-ZL · Privilege Escalation