Overview

Reconnaissance is learning as much as possible about the target environment before gaining attempting to gain access (external) and after access is gained (internal). It's the disciplined collection and interpretation of information during this phase that informs operational decisions.

Strategic context

Reconnaissance is the foundation of every offensive operation. It determines where effort should be applied and what access paths are available. Poor reconnaissance produces noise, while effective reconnaissance informs decisions and controlled execution. Reconnaissance is not confined to pre-access. It continues after initial entry and drives decision making throughout the attack lifecycle.

Reconnaissance categories build on one another but do not follow a strictly linear sequence. External reconnaissance can proceed independently. Internal reconnaissance and identity discovery often occur concurrently once a foothold is established, as they inform movement and escalation decisions equally.

For security leaders: Reconnaissance quality directly reflects operational maturity. Organizations with effective defensive reconnaissance programs recognize that attackers spend significant time learning target environments before taking any observable actions. Visibility into active reconnaissance activity (passive DNS queries, WHOIS requests, credential testing) provides early indicators of potentially sophisticated or mature threat actors.

Reconnaissance categories

External reconnaissance

External reconnaissance examines what is exposed from outside the environment. It focuses on internet-facing systems, publicly available information, authentication endpoints, and reachable infrastructure.

Internal reconnaissance

Internal reconnaissance begins after a foothold is established. It focuses on host context, network visibility, configuration, and environmental constraints.

Identity and trust discovery

Identity and trust discovery maps how authority is structured in the environment. It examines user roles, group inheritance, delegated privileges, and trust relationships.

Active Directory enumeration

Active Directory enumeration extends identity and trust discovery with Active Directory specific techniques. It focuses on domain user objects, group policy inheritance, delegation chains, and cross-domain trust relationships that enable lateral movement and privilege escalation.

Common mistakes

• Treating reconnaissance as a checklist rather than a targeted information-gathering operation

• Collecting data without interpreting relevance to operational objectives

• Failing to adjust reconnaissance strategy after access is obtained

• Relying exclusively on automated tools without manual verification of results

Operator notes

• Reconnaissance should reduce uncertainty, not increase noise

• The same information can support different decisions depending on phase

• Stop collecting when new information no longer informs decisions

• Reconnaissance is continuous, but must remain intentional