Enterprise Environment Discovery

Adversaries may discover configurations, conditions, relationships, activity, and other characteristics of an enterprise environment. This may include system and network configuration; active connections, processes, windows, and users; permissions, trust relationships, and policy settings; installed defensive or backup capabilities; network traffic; browser and registry information; or environmental properties such as location, language, time, connectivity, virtualization, debugging, and sandbox indicators.

Adversaries may query or passively observe this information to understand how the environment is configured and operating, identify access paths or security controls, detect monitoring or analysis, and select or adapt subsequent actions.

See the ATT&CK Discovery tactic for techniques describing specific environmental characteristics and discovery mechanisms.