# networksetup

> Configure network settings in System Preferences.

networksetup is an extensive tool for reading and setting various network configuration details useful for Discovery and Command and Control.

- Page: https://loobins.io/binaries/networksetup/
- Author: Jason Trost (@jason_trost)
- Created: 2023-04-22
- Tactics: Discovery, Command and Control

## Paths

- `/usr/sbin/networksetup`

## Example Use Cases

### network device enumeration

Use networksetup to display services with corresponding port and device in order they are tried for connecting to a network.

```bash
networksetup -listnetworkserviceorder
```

- Tactics: Discovery
- ATT&CK techniques: T1016
- Tags: network, configuration

### Detect connected network hardware

Use networksetup to detect new network hardware and create a default network service on the hardware.

```bash
networksetup -detectnewhardware
```

- Tactics: Discovery
- ATT&CK techniques: T1016
- Tags: network, configuration

### network device enumeration

Use networksetup to list all network interfaces, providing name, device name, MAC address.

```bash
networksetup -listallhardwareports
```

- Tactics: Discovery
- ATT&CK techniques: T1016
- Tags: network, configuration

### network device enumeration

Use networksetup to list all network interface names.

```bash
networksetup -listallnetworkservices
```

- Tactics: Discovery
- ATT&CK techniques: T1016
- Tags: network, configuration

### DNS server enumeration

Use networksetup to get configured DNS servers for a specific interface.

```bash
networksetup -getdnsservers Wi-Fi
```

- Tactics: Discovery
- ATT&CK techniques: T1016
- Tags: network, configuration, dns

### Enumerate configured web proxy URL for an interface

Displays web proxy auto-configuration information for the specified interface.

```bash
networksetup -getautoproxyurl "Thunderbolt Ethernet"
```

- Tactics: Discovery
- ATT&CK techniques: T1016
- Tags: network, configuration, proxy

### Enumerate configured web proxy for an interface

Displays standard web proxy information for the specified interface.

```bash
networksetup -getwebproxy "Wi-Fi"
```

- Tactics: Discovery
- ATT&CK techniques: T1016
- Tags: network, configuration, proxy

### Set the https web proxy for an interface

Use networksetup to set the https web proxy for an interface.

```bash
networksetup -setsecurewebproxy "Wi-Fi" 46.226.108.171
```

- Tactics: Command and Control
- ATT&CK techniques: T1090
- Tags: network, configuration, proxy

### Set the http web proxy for an interface

Use networksetup to set the http web proxy for an interface.

```bash
networksetup -setwebproxy "Wi-Fi" 46.226.108.171
```

- Tactics: Command and Control
- ATT&CK techniques: T1090
- Tags: network, configuration, proxy

### Set auto proxy URL for an interface

Use networksetup to set the proxy URL for an interface.

```bash
networksetup -setautoproxyurl "Wi-Fi" $autoProxyURL
```

- Tactics: Command and Control
- ATT&CK techniques: T1090
- Tags: network, configuration, proxy

### Enable auto proxy state

Use networksetup to enable the proxy auto-config

```bash
networksetup -setautoproxystate "Wi-Fi" on
```

- Tactics: Command and Control
- ATT&CK techniques: T1090
- Tags: network, configuration, proxy

## Detections

- No detections at time of publishing

## Resources

- [Threat Hunting the macOS edition Megan Carney (Report)](https://megancarney.com/presentations/ExternalReport_ThreatHuntingMacOS.pdf)
- [GrrCon 2018: Threat Hunting the macOS edition Megan Carney](https://www.youtube.com/watch?v=_K4gnSuDkRM&feature=youtu.be)
- [Mac Malware of 2017 - a comprehensive analysis of the new mac malware of 17](https://objective-see.org/blog/blog_0x25.html)
- [Ay MaMi - Analyzing a New macOS DNS Hijacker: OSX/MaMi](https://objective-see.org/blog/blog_0x26.html)
- [Analyzing OSX.DazzleSpy - A fully-featured cyber-espionage macOS implant](https://objective-see.org/blog/blog_0x6D.html)
- [The Mac Malware of 2018 - a comprehensive analysis of the new mac malware of - 18](https://objective-see.org/blog/blog_0x3C.html)
- [From The DPRK With Love - analyzing a recent north korean macOS backdoor](https://objective-see.org/blog/blog_0x6E.html)