All playbooks
Alert response · Discovery responders
Discovery and enumeration
Someone was mapping the estate. On its own it is weak evidence; alongside anything else it is a timeline anchor.
On its own this is weak evidence. Its value is as a timeline anchor: it dates the moment someone started looking.
What this does not establish
- Whether it is hostile. Administrators enumerate constantly.
- What was learned. The queries are logged; the answers are not.
- Whether it is the beginning. Discovery repeats throughout a chain.
0 of 8 ticked
Selected step
DetectStep 1 of 8
Identify the account, host and query shape
- One query is noise; a sequence within minutes is a person or a tool.
- Breadth is the signal — admins, then shares, then trusts.
- Note the window; you will correlate against it repeatedly.
- Start the timeline now: every action, who took it, when.