What are the signs that a compromised user account is being used for reconnaissance instead of normal work?

Common signs include logins from unfamiliar IP addresses, a password change followed by new MFA enrollment, rapid access to many applications in a short period, and bursts of document viewing or downloading that are far faster than human behavior. Those patterns suggest scripted reconnaissance, especially when the account starts touching internal policy, access, or operational documentation.

Why Reconnaissance Looks Different From Ordinary User Work

A compromised account used for reconnaissance usually leaves a pattern of curiosity without normal business context. Instead of working steadily inside one application set, the session tends to widen outward: mailbox, files, chat, shared drives, internal wikis, and admin-adjacent systems become targets in quick succession. That behaviour matters because a stolen account is often trying to map the environment before the defender notices a clear exfiltration event.

Reconnaissance also changes the shape of interaction. Human work usually has pauses, repetitive routines, and a limited set of destinations. Automated probing is flatter and faster, with short dwell times, unusual sequencing, and access to documents that do not fit the user’s role. When a compromised account begins reading policy, access, architecture, or incident-response material, it often signals that the attacker is selecting next steps rather than performing legitimate work. For broader context on how compromised non-human and machine identities are abused to extend access, DeepSeek breach shows how exposed credentials and internal data can widen the attacker’s view once trust is established.

In practice, many security teams spot reconnaissance only after the account has already touched enough internal content to reveal where the sensitive systems and controls live.

How to Separate Reconnaissance From Normal Productivity

The key is to compare behaviour against the account’s usual workload, not against an abstract idea of suspicious activity. A finance user opening invoices, expense tools, and policy documents may be normal. The same account suddenly enumerating directories, opening many unrelated files, touching access documentation, and moving across services it has never used before is much harder to explain as routine work. The most useful signal is not one event, but the sequence: authentication change, new device or location, rapid application traversal, and content access that does not match the user’s role.

Session speed matters because reconnaissance tends to compress what a human would normally do over hours into minutes. It may also show breadth without depth: many resources touched, little time spent in each, and no downstream task that explains the activity. If the user is not in a role that requires broad internal discovery, that pattern should be treated as environmental mapping rather than productivity. Current guidance for identity and access monitoring supports using role context, device context, and application sequence together, rather than relying on one anomaly alone. For control design guidance, NIST SP 800-53 Rev 5 Security and Privacy Controls is useful for mapping monitoring, access control, and audit expectations.

Useful indicators include:

Logins from a new geography or IP range followed by immediate discovery-like activity.
Rapid switching across many internal applications with no normal business trail.
Document access focused on policy, access, architecture, or operations material.
Failed logins, MFA changes, or session resets immediately before broad browsing.

For identity-specific research into how compromised machine and service identities are used to deepen access, The 52 NHI breaches Report provides useful patterns that often parallel human-account abuse in later-stage intrusion activity. These controls tend to break down when logs are fragmented across identity, endpoint, and application layers because the reconnaissance sequence is visible only when those sources are correlated.

When the Pattern Is Ambiguous and What Teams Get Wrong

Tighter detection often increases false positives, so organisations have to balance behavioural sensitivity against the risk of flagging legitimate but unusual work. That tradeoff is most obvious in help desks, incident responders, auditors, and executives, whose accounts may legitimately touch many systems in a short period. In those cases, the question is whether the sequence fits a known job function and whether the access depth matches the task, not simply whether the account is busy.

The most common mistake is treating one suspicious sign as decisive. A password reset, a new MFA enrollment, or a burst of file reads can each happen during ordinary account recovery or onboarding. The stronger indicator is a chain of events that shows environment mapping: new authentication conditions, wider-than-normal access, and repeated contact with internal reference material that would help an intruder understand where to move next. Another mistake is overlooking low-and-slow reconnaissance, where the attacker deliberately stays under volume thresholds but still collects enough structural knowledge to support later privilege escalation or data theft.

For teams tracking how AI-assisted intrusion changes that pattern, the most relevant external view is Anthropic — first AI-orchestrated cyber espionage campaign report, which illustrates how automation can accelerate reconnaissance once access is obtained.

Risk and Threat Considerations

Compromised-account reconnaissance is dangerous because it is usually the stage where an attacker learns what to steal, what to escalate, and where defensive visibility is weak. The account may still look “active,” which can delay response while the adversary maps privileges, documents, and internal dependencies.

Failure mechanism: Attackers exploit trusted authentication to browse broadly, collect internal knowledge, and identify higher-value targets without triggering obvious malware or exfiltration alerts. The abuse often succeeds because access monitoring is too coarse to distinguish legitimate work from fast, role-inconsistent discovery.

Impact: The organisation may lose time, containment opportunities, and confidentiality at once, while the attacker gains a roadmap for privilege escalation, lateral movement, or targeted theft.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1087 — Account Discovery	Compromised users often enumerate accounts and access paths during recon.
	T1217 — System Network Discovery	Rapid cross-system access can reflect discovery of internal topology and services.
	T1083 — File and Directory Discovery	Unusually broad document and directory access is a common recon indicator.
Recommendation — Hunt for account-discovery patterns and correlate them with unusual session breadth. Detect discovery-like activity across applications and network resources as early recon. Flag file-discovery bursts that exceed the account’s normal role-based file access.
NIST CSF 2.0	DE.CM — Continuous Monitoring	This question depends on detecting abnormal session and access patterns in real time.
	PR.AA — Identity Management, Authentication and Access Control	Compromised-account recon exploits weak trust in authenticated sessions and role scope.
Recommendation — Correlate identity, device, and application telemetry to surface recon behaviour quickly. Tighten authentication and access scope so unusual sessions are easier to challenge.
CIS Controls v8	6 — Access Control Management	Reconnaissance through a stolen account depends on overly broad or poorly reviewed access.
	8 — Audit Log Management	Reliable detection requires logs that preserve session sequence and access context.
Recommendation — Review and restrict account permissions so broad internal browsing is less useful to attackers. Centralise and retain identity and access logs long enough to reconstruct reconnaissance chains.

Practitioner Guidance

What to verify: Confirm whether the account’s recent sequence matches a real business task, including the applications touched, the files opened, and the device or location used. If the activity spans systems that the role does not normally require, treat the account as potentially compromised even if the user can explain one isolated login or file access.

Decision rule: If the account shows fast cross-application browsing plus access to internal reference material, prioritise containment and session review before trying to prove data loss. The practical question is whether the session is mapping the environment, not whether a final exfiltration step has already appeared.

What practitioners underestimate: Reconnaissance often looks like “just curiosity” in single-event logs. The important signal is correlation across identity, device, and content access, because that is where the attacker’s learning pattern becomes visible.

Practitioner takeaway: The safest assumption is that broad, fast, role-inconsistent browsing is not harmless until it is tied to a credible work objective and a normal session history.