Cyber Wiki Learning Path
MITRE ATT&CK®: Discovery
Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Discovery objective, with defensive explanations and linked BMC learning resources.
Recommended Sequence
49 connected entries
Account Discovery (T1087)
An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.
ATT&CK technique profile · IntermediateApplication Window Discovery (T1010)
Application Window Discovery (T1010) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedBackup Software Discovery (T1518.002)
Backup Software Discovery (T1518.002) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK technique profile · IntermediateBrowser Information Discovery (T1217)
Browser Information Discovery (T1217) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedCloud Account (T1087.004)
Cloud Account (T1087.004) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK sub-technique profile · AdvancedCloud Groups (T1069.003)
Cloud Groups (T1069.003) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK technique profile · IntermediateCloud Infrastructure Discovery (T1580)
Cloud Infrastructure Discovery (T1580) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateCloud Service Dashboard (T1538)
Cloud Service Dashboard (T1538) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateCloud Service Discovery (T1526)
Cloud Service Discovery (T1526) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateCloud Storage Object Discovery (T1619)
Cloud Storage Object Discovery (T1619) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateContainer and Resource Discovery (T1613)
Container and Resource Discovery (T1613) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateDebugger Evasion (T1622)
Debugger Evasion (T1622) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateDevice Driver Discovery (T1652)
Device Driver Discovery (T1652) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedDomain Account (T1087.002)
Domain Account (T1087.002) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK sub-technique profile · AdvancedDomain Groups (T1069.002)
Domain Groups (T1069.002) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK technique profile · IntermediateDomain Trust Discovery (T1482)
Domain Trust Discovery (T1482) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedEmail Account (T1087.003)
Email Account (T1087.003) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK technique profile · IntermediateFile and Directory Discovery (T1083)
File and Directory Discovery (T1083) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateGroup Policy Discovery (T1615)
Group Policy Discovery (T1615) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedInternet Connection Discovery (T1016.001)
Internet Connection Discovery (T1016.001) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK sub-technique profile · AdvancedLocal Account (T1087.001)
Local Account (T1087.001) is an Enterprise ATT&CK sub-technique under Account Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK sub-technique profile · AdvancedLocal Groups (T1069.001)
Local Groups (T1069.001) is an Enterprise ATT&CK sub-technique under Permission Groups Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK technique profile · IntermediateLocal Storage Discovery (T1680)
Local Storage Discovery (T1680) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateLog Enumeration (T1654)
Log Enumeration (T1654) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateNetwork Service Discovery (T1046)
Network Service Discovery (T1046) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateNetwork Share Discovery (T1135)
Network Share Discovery (T1135) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateNetwork Sniffing (T1040)
Network Sniffing (T1040) is an Enterprise ATT&CK technique associated with Credential Access, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediatePassword Policy Discovery (T1201)
Password Policy Discovery (T1201) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediatePeripheral Device Discovery (T1120)
Peripheral Device Discovery (T1120) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediatePermission Groups Discovery (T1069)
Permission Groups Discovery (T1069) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateProcess Discovery (T1057)
An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.
ATT&CK technique profile · IntermediateQuery Registry (T1012)
Query Registry (T1012) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateRemote System Discovery (T1018)
Remote System Discovery (T1018) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedSecurity Software Discovery (T1518.001)
Security Software Discovery (T1518.001) is an Enterprise ATT&CK sub-technique under Software Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK technique profile · IntermediateSoftware Discovery (T1518)
Software Discovery (T1518) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedSystem Checks (T1497.001)
System Checks (T1497.001) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
ATT&CK technique profile · IntermediateSystem Information Discovery (T1082)
An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.
ATT&CK sub-technique profile · AdvancedSystem Language Discovery (T1614.001)
System Language Discovery (T1614.001) is an Enterprise ATT&CK sub-technique under System Location Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.
ATT&CK technique profile · IntermediateSystem Location Discovery (T1614)
System Location Discovery (T1614) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSystem Network Configuration Discovery (T1016)
An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.
ATT&CK technique profile · IntermediateSystem Network Connections Discovery (T1049)
System Network Connections Discovery (T1049) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSystem Owner/User Discovery (T1033)
System Owner/User Discovery (T1033) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSystem Service Discovery (T1007)
System Service Discovery (T1007) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateSystem Time Discovery (T1124)
System Time Discovery (T1124) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedTime Based Checks (T1497.003)
Time Based Checks (T1497.003) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
ATT&CK sub-technique profile · AdvancedUser Activity Based Checks (T1497.002)
User Activity Based Checks (T1497.002) is an Enterprise ATT&CK sub-technique under Virtualization/Sandbox Evasion. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Discovery context.
ATT&CK technique profile · IntermediateVirtual Machine Discovery (T1673)
Virtual Machine Discovery (T1673) is an Enterprise ATT&CK technique associated with Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateVirtualization/Sandbox Evasion (T1497)
Virtualization/Sandbox Evasion (T1497) is an Enterprise ATT&CK technique associated with Stealth, Discovery. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedWi-Fi Discovery (T1016.002)
Wi-Fi Discovery (T1016.002) is an Enterprise ATT&CK sub-technique under System Network Configuration Discovery. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Discovery context.