Detecting discovery

During network discovery, threat actors may use a variety of techniques that can be implemented using specialized tools, scripts, system utilities, and sometimes manual analysis of files on the victim’s system. Accordingly, when searching for traces, we need to focus on the programs and scripts being run, as well as access to different files and locations. Moreover, during the investigation, attackers may save scan results or collected information on the victim’s hosts, which means that traces of new file creation will also be relevant to us.

Using specialized programs

Depending on the specifics of the threat actors, both self-written and well-known publicly available tools, such as various scanners or post-exploitation frameworks, can be used in attacks. For example, the most popular network scanning tools are SoftPerfect Network Scanner, Advanced IP Scanner, Advanced Port Scanner, Nmap, and Zenmap. ADRecon, ADFind, LDAP Browser, CrackMapExec...