Internal Reconnaissance in Domain Environments Detected by EDR

The report outlines common attacker reconnaissance and lateral movement techniques in Active Directory environments, detailing the use of port scanners, Windows net/PowerShell commands, PowerView, AdFind, and BloodHound/SharpHound to enumerate domains, identify targets, and progress toward domain admin privileges that can enable ransomware deployment or data exfiltration. It highlights detection challenges due to dual-use administrative tools and positions AhnLab EDR as a solution for monitoring, detecting, and responding to these behaviors.