Home TacticsDiscovery

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0007

Discovery

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network.

Associated Techniques(33)

T1087

Account Discovery

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.

4 sub-techniques

T1010

Application Window Discovery

Adversaries may attempt to get a listing of open application windows.

T1217

Browser Information Discovery

Adversaries may enumerate information about browsers to learn more about compromised environments.

T1580

Cloud Infrastructure Discovery

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service environment.

T1538

Cloud Service Dashboard

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment.

T1526

Cloud Service Discovery

An adversary may attempt to enumerate the cloud services running on a system after gaining access.

T1613

Container and Resource Discovery

Adversaries may attempt to discover containers and other resources that are available within a containers environment.

T1622

Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers.

T1652

Device Driver Discovery

Adversaries may attempt to enumerate local device drivers on a victim host.

T1482

Domain Trust Discovery

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities.

T1083

File and Directory Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information.

T1615

Group Policy Discovery

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation.

T1654

Log Enumeration

Adversaries may enumerate system and service logs to find useful data.

T1046

Network Service Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices.

T1135

Network Share Discovery

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather.

T1040

Network Sniffing

Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.

T1201

Password Policy Discovery

Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

T1120

Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

T1069

Permission Groups Discovery

Adversaries may attempt to discover group and permission settings.

3 sub-techniques

T1057

Process Discovery

Adversaries may attempt to get information about running processes on a system.

T1012

Query Registry

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

T1018

Remote System Discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network.

T1518

Software Discovery

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

1 sub-techniques

T1082

System Information Discovery

An adversary may attempt to get detailed information about the operating system and hardware.

T1614

System Location Discovery

Adversaries may gather information in an attempt to calculate the geographical location of a victim host.

1 sub-techniques

T1016

System Network Configuration Discovery

Adversaries may look for details about the network configuration and settings.

2 sub-techniques

T1049

System Network Connections Discovery

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing.

T1033

System Owner/User Discovery

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

T1007

System Service Discovery

Adversaries may try to gather information about registered local system services.

T1124

System Time Discovery

An adversary may gather the system time and/or time zone from a local or remote system.

T1497

Virtualization/Sandbox Evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

3 sub-techniques

T1619

Cloud Storage Object Discovery

Adversaries may enumerate objects in cloud storage infrastructure to identify targets for data collection.

T1680

Local Storage Discovery

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.

CIC-ATT&CK

ATT&CK Tactics

Recon

Resource Dev

Initial Access

Execution

Persistence

Priv Esc

Defense Evasion

Cred Access

Discovery

Lateral Move

Collection

C2

Exfiltration

Impact

Discovery

Associated Techniques(33)

Account Discovery

Application Window Discovery

Browser Information Discovery

Cloud Infrastructure Discovery

Cloud Service Dashboard

Cloud Service Discovery

Container and Resource Discovery

Debugger Evasion

Device Driver Discovery

Domain Trust Discovery

File and Directory Discovery

Group Policy Discovery

Log Enumeration

Network Service Discovery

Network Share Discovery

Network Sniffing

Password Policy Discovery

Peripheral Device Discovery

Permission Groups Discovery

Process Discovery

Query Registry

Remote System Discovery

Software Discovery

System Information Discovery

System Location Discovery

System Network Configuration Discovery

System Network Connections Discovery

System Owner/User Discovery

System Service Discovery

System Time Discovery

Virtualization/Sandbox Evasion

Cloud Storage Object Discovery

Local Storage Discovery