Discovery

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query , tasklist /svc , systemctl --type=service , and net start .

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Finding other hosts by IP, hostname, or Active Directory to plan lateral movement.

Detect it with
Sequential SMB or ICMP connections to many internal hosts from one workstation in a short window.

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.

Detect it with
Detecting the events leading up to sniffing network traffic may be the best method of detection.

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Listing running processes, usually to identify security tooling before disabling it.

Detect it with
tasklist and ps output followed quickly by attempts to stop security services.

Enumerating group membership to identify who holds the keys to the domain or the tenant.

Detect it with
Repeated LDAP queries for privileged group membership from a single non-administrative host.

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Enumerating local, domain, and cloud accounts to find privileged targets.

Detect it with
net user /domain, net group "Domain Admins", Get-ADUser bursts from non-admin workstations.

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.

Detect it with
Command-line interface monitoring may be useful to detect instances of net.exe or other command-line utilities being used to gather system time or time zone.

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force.

Detect it with
Monitor logs and processes for tools and command line arguments that may indicate they're being used for password policy discovery.

Adversaries may enumerate information about browsers to learn more about compromised environments.

Detect it with
Monitor processes and command-line arguments for actions that could be taken to gather browser bookmark information. Remote access tools with built-in features may interact directly using APIs to gather information.

Mapping trust relationships to find paths into other domains and forests.

Detect it with
nltest /domain_trusts, Get-DomainTrust, and BloodHound collector activity (SharpHound signatures).

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Detect it with
Virtualization, sandbox, user activity, and related discovery techniques will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS).

Detect it with
Cloud service discovery techniques will likely occur throughout an operation where an adversary is targeting cloud-based systems and services.

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features.

Detect it with
Monitor account activity logs to see actions performed and activity associated with the cloud service management console. Some cloud providers, such as AWS, provide distinct log events for login attempts to the management console.

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment.

Detect it with
Establish centralized logging for the activity of cloud infrastructure components.

Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.

Detect it with
Establish centralized logging for the activity of container and Kubernetes cluster components. This can be done by deploying logging agents on Kubernetes nodes and retrieving logs from sidecar proxies for application pods to detect malicious activity at the cluster level.

Adversaries may gather information in an attempt to calculate the geographical location of a victim host.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage.

Detect it with
System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Detect it with
Debugger related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may enumerate system and service logs to find useful data.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a Hypervisor CLI such as esxcli or vim-cmd (e.g.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.