What evidence may show internal reconnaissance?¶

Internal reconnaissance may be evidenced through commands, queries, network activity and repeated access to information about the environment.

Avoid the dangerous assumption¶

The dangerous assumption is that one suspicious command is enough to prove a reconnaissance phase.

It may not be.

Useful evidence may include:

• system-information commands
• directory and account queries
• network scans
• service enumeration
• share listings
• security-tool checks
• file searches
• route and configuration queries
• cloud resource enumeration
• scripted inventory activity.

Investigators should preserve:

• the full command or query
• the parent process
• the account context
• the source device
• the target systems
• the time and sequence
• the output where available
• the activity that followed.

Patterns are important.

Several related discovery actions in a short period may show deliberate orientation.

Regular automated queries may reflect legitimate monitoring.

Compare the activity with normal administration, support, deployment and security processes.

Where commands are entered through remote access or malware, preserve the control channel as well as the local event.

Do not rely only on product labels such as “reconnaissance detected”. Obtain the underlying events and rule logic.

Preserve failed and partial commands as well as successful ones. Errors, repeated attempts and changed syntax may show manual problem-solving and can help distinguish interactive activity from a prewritten script.

Where output was redirected to a file or clipboard, preserve that material because it may show exactly what information was obtained.

This may materially improve the reconstruction.

Operational takeaway¶

Establish reconnaissance from the pattern, sequence and context of discovery activity rather than from one command or one alert label.