TA0007 / Enterprise tactic
Discovery
Official MITRE tacticThe adversary is trying to figure out your environment.
Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
34 techniques
- T1087Account Discovery4 sub-techniques
- T1010Application Window Discovery
- T1217Browser Information Discovery
- T1580Cloud Infrastructure Discovery
- T1538Cloud Service Dashboard
- T1526Cloud Service Discovery
- T1619Cloud Storage Object Discovery
- T1613Container and Resource Discovery
- T1622Debugger Evasion
- T1652Device Driver Discovery
- T1482Domain Trust Discovery
- T1083File and Directory Discovery
- T1615Group Policy Discovery
- T1680Local Storage Discovery
- T1654Log Enumeration
- T1046Network Service Discovery
- T1135Network Share Discovery
- T1040Network Sniffing
- T1201Password Policy Discovery
- T1120Peripheral Device Discovery
- T1069Permission Groups Discovery3 sub-techniques
- T1057Process Discovery
- T1012Query Registry
- T1018Remote System Discovery
- T1518Software Discovery2 sub-techniques
- T1082System Information Discovery
- T1614System Location Discovery1 sub-techniques
- T1016System Network Configuration Discovery2 sub-techniques
- T1049System Network Connections Discovery
- T1033System Owner/User Discovery
- T1007System Service Discovery
- T1124System Time Discovery
- T1673Virtual Machine Discovery
- T1497Virtualization/Sandbox Evasion3 sub-techniques