Discovery

The adversary is trying to figure out your environment.

Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

In cloud environments, adversaries enumerate resources, IAM policies, network configurations, and storage buckets to map out the environment. They use cloud provider APIs to list instances, describe security groups, enumerate roles and policies, and identify potential targets for lateral movement or data exfiltration.

View Discovery on MITRE ATT&CK →