MITRE ATT&CKtactic
TA0007 Discovery
- Domain
- enterprise
- Version
- 1.0
- Created
- 2018-10-17
Description
The adversary is trying to figure out your environment.
Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
Related
Referenced by MITRE ATT&CK · tactic (49)
- T1680 Local Storage Discovery technique
- T1518.002 Backup Software Discovery sub-technique
- T1673 Virtual Machine Discovery technique
- T1016.002 Wi-Fi Discovery sub-technique
- T1654 Log Enumeration technique
- T1652 Device Driver Discovery technique
- T1622 Debugger Evasion technique
- T1619 Cloud Storage Object Discovery technique
- T1614.001 System Language Discovery sub-technique
- T1615 Group Policy Discovery technique
- T1614 System Location Discovery technique
- T1613 Container and Resource Discovery technique
- T1016.001 Internet Connection Discovery sub-technique
- T1580 Cloud Infrastructure Discovery technique
- T1069.001 Local Groups sub-technique
- T1497.001 System Checks sub-technique
- T1497.002 User Activity Based Checks sub-technique
- T1497.003 Time Based Checks sub-technique
- T1069.002 Domain Groups sub-technique
- T1069.003 Cloud Groups sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1087.003 Email Account sub-technique
- T1087.004 Cloud Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1518 Software Discovery technique
- T1526 Cloud Service Discovery technique
- T1538 Cloud Service Dashboard technique
- T1497 Virtualization/Sandbox Evasion technique
- T1482 Domain Trust Discovery technique