What is the phase called when an adversary, after penetrating the network, gathers information such as local user context, hostname, IP addresses, remote systems, and active programs?

What is the phase called when an adversary, after penetrating the network, gathers information such as local user context, hostname, IP addresses, remote systems, and active programs?

• A. Use of PowerShell
• B. Internal Reconnaissance
• C. Unspecified Proxy Activities
• D. HTTP User Agent

Answer: (B)

Internal reconnaissance is the phase where, after gaining access, an attacker gathers information about the local environment to map what’s inside the network. By collecting details like the user context, hostname, IP addresses, reachable remote systems, and active programs, the attacker learns how the network is laid out, what privileges exist, and where to move next. This information helps plan lateral movement and identify targets that could be exploited, making it a crucial step right after initial access. Tools or artifacts mentioned in other choices aren’t phases themselves. For example, PowerShell is a command-line tool that can be used during various stages, not a phase name; proxy activity refers to how traffic is routed and isn’t a formal phase; an HTTP User-Agent is just a request header and also not a phase.

Internal reconnaissance is the phase where, after gaining access, an attacker gathers information about the local environment to map what’s inside the network. By collecting details like the user context, hostname, IP addresses, reachable remote systems, and active programs, the attacker learns how the network is laid out, what privileges exist, and where to move next. This information helps plan lateral movement and identify targets that could be exploited, making it a crucial step right after initial access.

Tools or artifacts mentioned in other choices aren’t phases themselves. For example, PowerShell is a command-line tool that can be used during various stages, not a phase name; proxy activity refers to how traffic is routed and isn’t a formal phase; an HTTP User-Agent is just a request header and also not a phase.