Attempt to get detailed information about the operating system and hardware, such as version, patches, hotfixes, service packs, and architecture (System Information Discovery [T1082]) - Enumerate files and directories or search in specific locations of a host or network share for particular information within a file system (File and Directory Discovery [T1083]) - Get a list of security software, configurations, defensive tools, and sensors installed on the system (Software Discovery: Security Software Discovery [T1518.001]) - Procure information about running processes on a system to understand standard software running on network systems (Process Discovery [T1057]) - Identify primary users, currently logged in users, sets of users that commonly use a system, or active or inactive users (System Owner/User Discovery [T1033]) - Enumerate browser bookmarks to learn more about compromised hosts, reveal personal information about users, and expose details about internal network resources (Browser Bookmark Discovery [T1217]) - Look for information on network configuration and system settings on compromised systems, or perform remote system discovery (System Network Configuration Discovery [T1016]) - Interact with the Windows Registry to gather information about the system, configuration, and installed software (Query Registry [T1012]) - Get a list of open application windows to learn how the system is used or give context to data collected (Application Window Discovery [T1010]) - Attempt to get a listing of local system or domain accounts in the compromised system (Account Discovery [T1087]) - Obtain a list of network connections to and from the compromised system or remote system by querying for information over the network (System Network Connections Discovery [T1049