MITRE ATT&CK Tactic

Discovery (TA0007)

The adversary is trying to figure out your environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.

Techniques (34)

T1007System Service Discovery T1010Application Window Discovery T1012Query Registry T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1040Network Sniffing T1046Network Service Discovery T1049System Network Connections Discovery T1057Process Discovery T1069Permission Groups Discovery T1082System Information Discovery T1083File and Directory Discovery T1087Account Discovery T1120Peripheral Device Discovery T1124System Time Discovery T1135Network Share Discovery T1201Password Policy Discovery T1217Browser Information Discovery T1482Domain Trust Discovery T1497Virtualization/Sandbox Evasion T1518Software Discovery T1526Cloud Service Discovery T1538Cloud Service Dashboard T1580Cloud Infrastructure Discovery T1613Container and Resource Discovery T1614System Location Discovery T1615Group Policy Discovery T1619Cloud Storage Object Discovery T1622Debugger Evasion T1652Device Driver Discovery T1654Log Enumeration T1673Virtual Machine Discovery T1680Local Storage Discovery

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Source: TA0007on MITRE ATT&CK.

Discovery (TA0007)

Techniques (34)

Explore Gold

Security Data & Tools

Products

Use Cases

Company

Discovery (TA0007)

Techniques (34)