Almost every intrusion pauses to look around, and the Discovery tactic (TA0007) is where an attacker's commands start to differ from the people and services that normally run on a host. ATT&CK v20 describes Discovery as the adversary "trying to figure out your environment": techniques used to gain knowledge about the system and internal network, often with native operating system tools, before deciding how to act. Single discovery commands such as whoami or net group are noisy and mostly legitimate, so alerting on each technique in isolation fails. This hub covers the 34 Discovery techniques and 15 sub-techniques in v20, shows from the ATT&CK data which ones attackers lean on, and sets out a baselining approach that turns low-value events into reliable detections. It is written for detection engineers, threat hunters and SOC leads.
Key takeaways
- Discovery is almost universal. In the v20 dataset 115 of 178 active groups, 578 malware families, 53 tools and 36 campaigns have at least one Discovery procedure, 3,426 records in total.
- Host fundamentals dominate. System Information Discovery (T1082, 437 records), File and Directory Discovery (T1083, 381), Process Discovery (T1057, 326), System Network Configuration Discovery (T1016, 325 including sub-techniques) and System Owner/User Discovery (T1033, 251) lead the counts.
- Prevention barely applies. 23 of the 34 techniques have no ATT&CK mitigation at all; User Account Management (M1018) is the most common mitigation, mapped to 8 techniques or sub-techniques.
- Sequences beat single events. Several commands from one parent process within minutes, from an identity that never runs them, is the signal. One whoami is not.
- Cloud and identity discovery uses APIs, not commands. GetCallerIdentity, ListBuckets, Graph service principal listings and Kubernetes list calls are the cloud equivalent of net user, and they are logged by default in most control planes.
What Discovery looks like in practice
Discovery sits between gaining a foothold and acting on it. After initial access an attacker needs answers to a short set of questions, and the techniques map onto them.
- Where am I and who am I: T1082 System Information Discovery, T1033 System Owner/User Discovery, T1016 System Network Configuration Discovery, T1614 System Location Discovery (language checks are often used to avoid certain regions).
- Is anyone watching: T1518.001 Security Software Discovery (142 records), T1057 Process Discovery, T1654 Log Enumeration, and the two techniques shared with the v20 Stealth tactic, T1497 Virtualization/Sandbox Evasion and T1622 Debugger Evasion.
- What can I reach: T1018 Remote System Discovery, T1046 Network Service Discovery, T1135 Network Share Discovery, T1049 System Network Connections Discovery, T1040 Network Sniffing (also a Credential Access technique).
- Who has power: T1087 Account Discovery, T1069 Permission Groups Discovery, T1482 Domain Trust Discovery, T1615 Group Policy Discovery, T1201 Password Policy Discovery.
- What is valuable: T1083 File and Directory Discovery, T1680 Local Storage Discovery, T1217 Browser Information Discovery, T1619 Cloud Storage Object Discovery.
- What is in the cloud: T1580 Cloud Infrastructure Discovery, T1526 Cloud Service Discovery, T1538 Cloud Service Dashboard, T1613 Container and Resource Discovery, T1673 Virtual Machine Discovery.
Malware runs much of this automatically: 2,434 of the 3,426 procedure records come from malware, because implants report host details to their operators on first run. Hands-on operators add the identity and network questions. CISA's advisory AA24-038A on Volt Typhoon, the group with the most distinct Discovery techniques and sub-techniques in v20 (24), lists built-in tools such as net user and net group, netstat, nltest, quser, systeminfo, tasklist, whoami, wmic, ping, ntdsutil, dnscmd, ldifde, wevtutil and PowerShell, including Get-EventLog queries that pulled successful logon events (Event ID 4624) to learn who logs on where. That is living off the land: nothing malicious is installed, so the evidence is in the pattern of use.
Every technique in the tactic
Counts are computed from the ATT&CK v20 Enterprise STIX dataset: procedure records are non-revoked "uses" relationships from groups, software and campaigns to the technique and its sub-techniques; mitigations are distinct "mitigates" relationships across the technique and its sub-techniques. Sub-technique counts are shown in brackets.
| ID | Technique | Sub-techniques (records) | Procedure records | Mitigations | Also under |
|---|---|---|---|---|---|
| T1007 | T1007 System Service Discovery | None | 70 | 0 | None |
| T1010 | T1010 Application Window Discovery | None | 37 | 0 | None |
| T1012 | T1012 Query Registry | None | 120 | 0 | None |
| T1016 | T1016 System Network Configuration Discovery | .001 Internet Connection Discovery (26); .002 Wi-Fi Discovery (7) | 325 | 0 | None |
| T1018 | T1018 Remote System Discovery | None | 108 | 0 | None |
| T1033 | T1033 System Owner/User Discovery | None | 251 | 0 | None |
| T1040 | MITRE ATT&CK T1040 Network Sniffing | None | 28 | 4 | Credential Access |
| T1046 | T1046 Network Service Discovery | None | 77 | 3 | None |
| T1049 | T1049 System Network Connections Discovery | None | 99 | 0 | None |
| T1057 | T1057 Process Discovery | None | 326 | 0 | None |
| T1069 | T1087 and T1069 Account and Permission Group Discovery Defensive Guide | .001 Local Groups (32); .002 Domain Groups (39); .003 Cloud Groups (5) | 89 | 0 | None |
| T1082 | T1082 System Information Discovery | None | 437 | 0 | None |
| T1083 | T1083 File and Directory Discovery | None | 381 | 0 | None |
| T1087 | T1087 and T1069 Account and Permission Group Discovery Defensive Guide | .001 Local Account (66); .002 Domain Account (62); .003 Email Account (15); .004 Cloud Account (7) | 161 | 3 | None |
| T1120 | T1120 Peripheral Device Discovery | None | 58 | 0 | None |
| T1124 | T1124 System Time Discovery | None | 104 | 0 | None |
| T1135 | T1135 Network Share Discovery Defensive Guide | None | 79 | 1 | None |
| T1201 | T1201 Password Policy Discovery | None | 8 | 1 | None |
| T1217 | T1217 Browser Information Discovery Defensive Guide | None | 31 | 0 | None |
| T1482 | T1482 Domain Trust Discovery | None | 34 | 2 | None |
| T1497 | MITRE ATT&CK T1497 Virtualization/Sandbox Evasion | .001 System Checks (72); .002 User Activity Based Checks (7); .003 Time Based Checks (50) | 156 | 0 | Stealth |
| T1518 | T1518 Software Discovery | .001 Security Software Discovery (142); .002 Backup Software Discovery (1) | 197 | 0 | None |
| T1526 | T1526 Cloud Service Discovery | None | 7 | 0 | None |
| T1538 | T1538 Cloud Service Dashboard | None | 1 | 1 | None |
| T1580 | T1580 and T1619 Cloud Infrastructure and Storage Discovery Guide | None | 6 | 1 | None |
| T1613 | T1613 Container and Resource Discovery | None | 5 | 3 | None |
| T1614 | T1614 System Location Discovery | .001 System Language Discovery (42) | 70 | 0 | None |
| T1615 | T1615 Group Policy Discovery | None | 7 | 0 | None |
| T1619 | T1619 Cloud Storage Object Discovery | None | 4 | 1 | None |
| T1622 | T1622 Debugger Evasion | None | 27 | 0 | Stealth |
| T1652 | T1652 Device Driver Discovery | None | 4 | 0 | None |
| T1654 | T1654 Log Enumeration | None | 10 | 1 | None |
| T1673 | T1673 Virtual Machine Discovery | None | 6 | 0 | None |
| T1680 | T1680 Local Storage Discovery | None | 103 | 0 | None |
The four highest-volume techniques have no mitigation in ATT&CK, which is honest: you cannot stop a process from asking the operating system its own hostname. The techniques that do carry mitigations are those that touch shared resources (shares, trusts, cloud APIs, containers), where permissions can limit what an enumerating identity sees. For the full mitigation catalogue see ATT&CK Mitigations.
A baselining approach to detection
ATT&CK v20 attaches a detection strategy to every Discovery technique, and the analytics share a theme: they look for enumeration from places it does not normally come from. DET0129 for domain account enumeration flags net.exe, PowerShell, WMI or LDAP queries from non-domain-controller or non-admin endpoints; DET0161 for password policy discovery describes a cause and effect chain in which a policy query is followed by account enumeration or password attempts by the same user. Build on that in four steps.
- Collect the right telemetry. On Windows enable Audit Process Creation and the "Include command line in process creation events" setting (off by default) so Event ID 4688 carries the command line, or use Sysmon Event ID 1. Add PowerShell script block logging (Event ID 4104), Sysmon Event IDs 3 and 22 for network connections and DNS queries, and Event ID 4662 or 4661 for directory object access where volume allows. On Linux use auditd execve rules. In cloud, keep management event logging on (CloudTrail, Azure activity and Entra audit logs, Kubernetes API server audit).
- Baseline who runs what. For each discovery binary and API call, record which accounts, hosts and parent processes run it in a normal month. Administrators, management agents, monitoring tools and inventory scanners will dominate. Tag them rather than suppress them blindly.
- Alert on bursts and outliers. Score a host or session when several distinct discovery techniques run within a short window (for example three or more of T1082, T1033, T1016, T1087, T1069 and T1482 within ten minutes) from a parent such as an Office application, a web server worker, a scripting host or a remote session not in the baseline. Weight identity and trust queries (nltest /domain_trusts, AdFind style LDAP queries, net group "Domain Admins") higher than host queries.
- Correlate forward. Discovery alone is a lead. Join it to what follows from the same identity: credential access, remote service logons, archive creation. ATT&CK's T1069.002 analytic explicitly pairs group enumeration with subsequent LSASS access.
Cloud and identity discovery
In cloud the first call after stolen keys are tested is usually an identity check. The 230 Million AWS Cloud Environments Campaign 2024 page describes attackers who, after harvesting keys from exposed .env files, called GetCallerIdentity, then ListUsers and ListBuckets, and probed SES with GetSendQuota. ATT&CK's detection strategies for T1580 and T1526 point at the same calls (DescribeInstances, ListBuckets, DescribeDBInstances, ListFunctions) and, for identity providers, at large-scale ListApplications or ListServicePrincipals queries. Baseline these per principal: a CI role that only ever calls ecr:GetAuthorizationToken has no reason to list IAM users. See How to Investigate CloudTrail for a Compromised Access Key and the Cloud Detection Engineering Guide.
Deception for a noisy tactic
Because discovery is the stage where attackers list things, decoys that only appear in listings are unusually effective: a decoy privileged account surfaced by net group queries, a fake share, a cloud key that should never be used. Any interaction is high fidelity. See the Decoy accounts in Active Directory page and the Honeytokens and Canary Credentials Guide.
Prevention and exposure reduction
Prevention for Discovery is about limiting what an enumerating identity learns, not blocking the commands.
| Mitigation | Techniques it maps to in v20 | Practical action |
|---|---|---|
| M1018 User Account Management | 8: T1040, T1087, T1087.004, T1538, T1580, T1613, T1619, T1654 | Scope cloud and container roles so workloads cannot list resources they do not use; restrict Kubernetes list and get verbs |
| M1030 Network Segmentation | 4: T1040, T1046, T1482, T1613 | Stop workstations reaching server management ports and other workstations; reduces what scans can find |
| M1028 Operating System Configuration | 4: T1087, T1087.001, T1087.002, T1135 | Restrict anonymous enumeration of SAM accounts and shares; review remote SAM call restrictions |
| M1047 Audit | 2: T1087.004, T1482 | Review trust relationships and who can read cloud directory and inventory data |
| M1041 Encrypt Sensitive Information, M1032 Multi-factor Authentication | 1 each (T1040) | Encrypt protocols so sniffing yields nothing; MFA limits the value of credentials seen on the wire |
Active Directory makes most objects readable by any authenticated user by default, so domain discovery cannot be prevented by permissions alone; reduce what the graph reveals instead. See the BloodHound and Active Directory Attack Path Guide and Active Directory ACL and Delegation Hygiene Guide.
Where identity fits
Discovery is often the first thing a stolen non-human identity is used for. A leaked access key, service account password or OAuth token gives no context on its own, so attackers spend their first minutes asking what it can see. Service accounts are also the hardest identities to baseline if nobody knows their purpose. Give every service account and workload role an owner and a documented purpose, then alert when it calls discovery APIs or runs discovery commands outside that purpose. See the How to build a service account inventory from Active Directory page.
Measuring progress
- Telemetry coverage: percentage of Windows endpoints sending process creation with command line, and percentage of cloud accounts with management event logging centralised.
- Baseline coverage: percentage of service accounts and workload roles with a documented normal set of API calls.
- Burst detection quality: true positive rate of the multi-technique burst analytic after tuning, reviewed monthly.
- Purple team results: share of emulated discovery sequences (from adversary emulation plans) detected within 15 minutes.
- Decoy coverage: number of decoy accounts, shares and cloud keys in place, and time to alert on a decoy touch.
Framework mapping
| Area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Process, command line and API audit logging | AU-2 Event Logging, AU-12 Audit Record Generation | DE.CM-09 |
| Behavioural baselines and anomaly detection | SI-4 System Monitoring | DE.AE-02 |
| Limiting what identities can enumerate | AC-6 Least Privilege | PR.AA-05 |
| Segmentation to reduce reachable services | SC-7 Boundary Protection | PR.IR-01 |
| Decoys and deception | SC-26 Decoys | DE.CM-01 |
Common failure patterns
- One rule per command: alerting on every whoami or ipconfig floods the queue and gets disabled within weeks.
- Command line not logged: Event ID 4688 without the command line shows net.exe ran but not whether it listed Domain Admins.
- Management tools blanket excluded: excluding a remote management agent entirely hides an attacker who uses it, which Volt Typhoon did with tools already present.
- Cloud reads not reviewed: teams watch write and delete API calls and ignore List and Describe calls, so the first minutes after a key leak go unseen.
- No owner for service identities: without a stated purpose, no one can tell whether a service account listing users is normal.
Practitioner checklist
- Turn on process creation auditing with command line, or deploy Sysmon, on all Windows hosts.
- Enable PowerShell script block logging and centralise it.
- Build a 30 day baseline of discovery commands by account, host and parent process.
- Deploy a multi-technique burst analytic and tune it with the baseline.
- Alert on identity and trust enumeration from non-administrative endpoints.
- Alert on GetCallerIdentity followed by List calls from new principals or new source addresses.
- Restrict Kubernetes list verbs and cloud list permissions for workload identities.
- Place decoy accounts, shares and cloud keys that appear in enumeration results.
- Run a discovery emulation exercise each quarter and record detection time.
Standards and references
- MITRE ATT&CK: Discovery (TA0007)
- MITRE ATT&CK: Account Discovery (T1087)
- MITRE ATT&CK: System Information Discovery (T1082)
- CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
- CISA and partners: Identifying and Mitigating Living Off the Land Techniques
- Microsoft Learn: Command line process auditing
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: ATT&CK Mitigations · T1087 and T1069 Account and Permission Group Discovery Defensive Guide · Detection Engineering Guide · Active Directory Security Monitoring and Event IDs Guide · ATT&CK Collection Tactic Guide