Windows Reconnaissance Commands

Built-in Windows commands for post-exploitation situational awareness. These require no external tools — they work on any Windows system, are less likely to trigger application whitelisting, and map directly to MITRE ATT&CK Discovery techniques.

Network and system identity

Command	Purpose	MITRE ATT&CK
arp -a	Display the ARP cache — reveals other machines on the local network segment	T1018 (Remote System Discovery)
hostname	Return the system hostname	T1082 (System Information Discovery)
`systeminfo`	OS version, patch level, hardware, domain membership, boot time	T1082
netstat -ano	Open/listening ports and owning process IDs	T1049 (System Network Connections Discovery)

Users, groups, and privileges

Command	Purpose	MITRE ATT&CK
whoami /groups	Current user’s group memberships	T1033 (System Owner/User Discovery)
whoami /priv	Current user’s privileges (SeImpersonate, SeDebug, etc.)	T1033
query session	Other users currently logged in	T1033
net user	All local user accounts	T1087.001 (Local Account)
net user $USERNAME	Details for a specific user	T1087.001
net localgroup	All local groups	T1069.001 (Local Groups)
net localgroup administrators	Members of the local Administrators group	T1069.001
net group /domain	Domain groups (requires domain membership)	T1069.002 (Domain Groups)
net group "Domain Admins" /domain	Domain admin accounts	T1069.002

Shares, services, and tasks

Command	Purpose	MITRE ATT&CK
net share	All shares exported by this machine	T1135 (Network Share Discovery)
net start	All running services	T1007 (System Service Discovery)
sc query	Query/manipulate services (conflicts with a PowerShell alias!)	T1007
schtasks	Scheduled tasks (abuse patterns: exploit-windows-scheduled-tasks)	T1053.005 (Scheduled Task)

Credentials and registry

Command	Purpose	MITRE ATT&CK
cmdkey /list	Saved credentials (Credential Manager)	T1555 (Credentials from Password Stores)
reg query	Query registry keys and values	T1012 (Query Registry)

Policy and drivers

Command	Purpose	MITRE ATT&CK
net accounts	Local machine password/lockout policies	T1201 (Password Policy Discovery)
net accounts /domain	Domain password/lockout policies	T1201
driverquery	Installed drivers (attack surface inventory)	T1082

Notes

• sc conflicts with the PowerShell Set-Content alias. Use sc.exe in PowerShell, or run from cmd.exe.
• Commands prefixed with /domain require the machine to be domain-joined and the current user to have domain read access (any authenticated user by default).
• These are the minimum viable recon — supplement with PowerShell equivalents (Get-LocalUser, Get-LocalGroup, Get-Service, etc.) and dedicated tools like PowerView for deeper AD enumeration.

Defense perspective

These commands are ubiquitous and low-noise, making detection difficult. However:

• Sysmon event 1 (process creation) logs command lines — forward to SIEM and alert on recon patterns (whoami /priv, net group "Domain Admins")
• Baseline normal admin activity; alert on recon commands from unexpected accounts or machines
• See windows-event-logs and get-winevent for how to query these events

Sources

• MITRE ATT&CK — Discovery Tactic (TA0007)
• MITRE ATT&CK T1033 — System Owner/User Discovery
• MITRE ATT&CK T1082 — System Information Discovery

Related: windows-event-logs, get-winevent, windows-ntfs-permissions, powershell-reverse-shell, amsi-bypass, whoami, ipconfig, findstr, windows-saved-credentials, unattended-installation-credentials, powershell-service-management, putty-saved-sessions, rdp-restricted-admin-mode, net-windows-command, windows-privesc-recon-scripts, windows-unix-command-equivalents, dir, reg, nbtscan, secedit-bulk-privilege-edit