Host and domain reconnaissance battery

host_recon_commands

Runs the read-only enumeration commands that normally follow a successful intrusion (user, group, domain, share, process, network and shadow-copy listings). Nothing is modified.

Severity low how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1016	System Network Configuration Discovery	Discovery	coverage statistics
T1033	System Owner/User Discovery	Discovery	coverage statistics
T1057	Process Discovery	Discovery	coverage statistics
T1082	System Information Discovery	Discovery	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other discovery tests

Other tests in the Discovery category.
Test	What it does	Severity
Active Directory enumeration ad_domain_enumeration	Runs the read-only directory queries that precede every AD attack: domain controllers, domain and enterprise administrators, password policy, trusts, …	high
Kerberoast target enumeration ad_spn_kerberoast_recon	Enumerates accounts with a servicePrincipalName — the exact target list a Kerberoast attack works from — and reports how many were found and how many …	high
Nearest-neighbour subnet scan subnet_neighbour_scan	TCP-connect sweep of up to 24 neighbouring addresses in the local /24 on ports 445/3389/22/80/139. Strictly limited to the local subnet; no payload is…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.