Recon-style enumeration of internal infrastructure documentation files

Ibrahim Saud@tektrix

•updated Sep 23, 2026•1•0•8

Detects the use of native Windows utilities such as findstr, cmd, powershell, or file copy utilities with recursive flags to search for files containing keywords related to internal infrastructure documentation, such as network diagrams, server inventories, firewall configs, or AD topologies. This activity is indicative of information gathering and reconnaissance by an adversary.