Reconnaissance LOLBins & Internal Host Discovery
Adversaries abuse built-in command line tools to enumerate local users, domain trust relationships, network shares, installed software, and security configurations prior to lateral movement.
Adversaries chain commands like whoami, net.exe, ipconfig, and systeminfo during post-exploitation triage to orient themselves inside target networks.
Catalog of Reconnaissance LOLBins
Displaying 6 itemsPktmon.exe
Capture Network Packets on the windows 10 with October 2018 Update or later.
pktmon.exe start --etwPsr.exe
Windows Problem Steps Recorder, used to record screen and clicks.
psr.exe /start /output {PATH_ABSOLUTE:.zip} /sc 1 /gui 0Nmcap.exe
Command-line packet capture utility from Microsoft Network Monitor 3.x.
nmcap.exe /network * /capture /file {PATH_ABSOLUTE:.cap}scutil
Scutil manages system configuration parameters. Attackers use it during discovery to retrieve the computer name, DNS servers, and network proxy configurations.
scutil --get ComputerNamelog
Log queries the macOS Unified Logging System. Attackers interrogate system logs to find sensitive tokens, user activities, or cleartext credentials.
log show --predicate 'process == "sudo"' --info --last 1dcsrutil
Csrutil inspects and modifies System Integrity Protection (SIP) settings. Attackers check SIP status prior to attempting kernel extensions or rootkit loading.
csrutil statusExplore Other Attack Objectives & Tactics
