Investigating reconnaissance attacks
The reconnaissance phase is the first phase the attacker conducts, either externally before actively attacking their target, or internally after gaining actual access to the victim’s environment. The external reconnaissance phase is usually conducted to collect information about the target victim’s emails, IPs, services, open ports, vulnerabilities, and so on. The internal reconnaissance phase is usually conducted by threat actors after gaining initial access to the victim’s system to discover the installed binaries and logged-on users on the infected system, machines in the same network running services such as WinRM and RDP for lateral movement, and so on. In this section, we will focus on the firewall scope for both external and internal reconnaissance behaviors, as follows:
- Public-facing IPs and port scanning
- Internal network service discovery
Let’s look at both of these in detail.
