Detect file and directory discovery by watching for rapid enumeration activity, repeated listing commands, or processes that access many paths in a short time. Correlate with user context and privilege level, and flag discovery on servers, file shares, or sensitive locations that the account does not normally browse. Review follow-on compression or staging activity.
What file and directory discovery looks like in telemetry
file and directory discovery usually shows up as a burst of read-only activity that does not match the user’s normal work pattern. Look for repeated directory listings, recursive searches, wildcard-driven enumeration, or rapid access to many folders and filenames in a short window. The key signal is breadth and speed, not a single file open.
Context matters because legitimate discovery happens too. An administrator, backup job, indexer, or migration tool may touch many paths at once, but those actions should be tied to a known process, expected host, and expected account. Discovery becomes suspicious when it appears on a server, file share, or sensitive location the account does not usually browse, especially if the process lineage is unusual.
Security teams should also separate normal application behaviour from operator-driven enumeration. A script, shell, or remote management session that suddenly traverses user home directories, shared drives, or protected project areas can indicate the early stage of post-compromise reconnaissance, especially when the access pattern is broader than the role requires.
How to distinguish discovery from normal browsing
Detection works best when file and directory access is measured against a baseline of role, host, time, and process. A developer’s search across a source tree looks different from an admin’s inventory scan on a file server, and both differ from a compromised account walking through many directories to find sensitive material. That comparison reduces false positives and makes the alert actionable.
High-signal behaviours include command-line enumeration, repeated path probes, use of system utilities to list or query directory contents, and short-lived processes that fan out across many locations. Discovery often produces a visible pattern of “touch many paths, read little data,” which is different from the heavier read patterns seen in data theft or bulk transfer.
MITRE ATT&CK Guide for Defenders is useful here because file and directory discovery maps cleanly to a defender’s technique-oriented view of suspicious enumeration and follow-on activity.
What to correlate after discovery starts
Discovery is most useful as an early warning sign when it is correlated with privilege, host sensitivity, and what happens next. If the same account begins enumerating files and then compresses, stages, or moves data, that sequence is more concerning than discovery alone. The follow-on action often tells you whether the activity is routine administration or preparatory exfiltration.
Also check whether the account should even have visibility into the paths being touched. Discovery on a share or server outside the user’s normal scope, especially from an account with elevated rights or an interactive session that does not fit the workload, increases confidence that the activity deserves investigation. Process ancestry is important because the same command can be benign when launched by an approved maintenance tool and suspicious when launched by an ad hoc shell.
Data Security Guide helps frame the downstream question: once discovery touches sensitive data locations, you need to know whether the paths, shares, and permissions themselves are already too exposed.
Risk and Threat Considerations
Discovery activity is often the first observable step before staging, compression, credential hunting, or lateral movement. The main risk is not the directory listing itself, but the fact that enumeration reveals where valuable data, tooling, or administrative material lives, and it can do so quietly before a larger theft or sabotage event.
Failure mechanism: Attackers or misuse cases abuse ordinary listing and search behaviour to map the filesystem, identify sensitive directories, and locate files worth compressing, copying, or encrypting later. The same pattern can also expose weak segmentation when a low-privilege account can enumerate far more than it should.
Impact: Discovery can accelerate compromise by shortening the time needed to find high-value targets, and it can expose mis-scoped permissions even before any data leaves the environment. If the activity is followed by archive creation or transfer, the chance of data loss rises sharply.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1083 — File and Directory Discovery | Directly covers filesystem enumeration and discovery activity. |
| Recommendation — Map file and directory enumeration to T1083 and alert on abnormal path traversal patterns. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Discovery detection depends on log visibility for process and path access events. |
| Recommendation — Collect and review file access and process telemetry to spot abnormal enumeration bursts. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Discovery detection is an anomaly-monitoring problem across hosts and identities. |
| Recommendation — Baseline normal path-access behaviour and flag anomalous enumeration activity for review. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Enumeration detection requires audit records for file, directory, and process activity. |
| Recommendation — Enable audit generation for file system and process events needed to detect discovery. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Application-side file access and directory enumeration need logging to reveal discovery patterns. |
| Recommendation — Log sensitive path access and repeated listing behaviour so discovery can be investigated. | ||
Practitioner Guidance
What to prioritize: Treat discovery alerts as sequence-based investigations, not single-event alerts. The most useful triage question is whether enumeration is followed by compression, staging, unusual archive creation, or access to directories the account rarely touches.
What to verify: Confirm the process, parent process, host role, and account purpose before trusting the activity. If a service account or admin context is enumerating file shares outside its normal scope, verify whether the action was scheduled, scripted, or part of an approved maintenance job.
Practitioner takeaway: The best detection is one that turns “many paths in little time” into a sequence you can explain, because explanation is what separates routine administration from early-stage compromise.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org