Hunting Reconnaissance: Finding Pre-Intrusion Warning Signals

Most hunting effort, understandably, concentrates on activity that’s already happened inside the network—the earlier piece on the kill chain made the case that installation and command-and-control are where hunting has the most leverage. But there’s a real, if narrower, opportunity sitting even earlier: reconnaissance, the stage where an attacker is still gathering intelligence before ever launching the actual intrusion. Catching activity here means acting before anything has actually breached your environment at all.

Why This Stage Gets Skipped, and Why It Shouldn’t Be Entirely

The honest reason reconnaissance hunting gets less attention is that most of it genuinely happens outside your visibility—an attacker researching your organization through public sources, LinkedIn profiles, job postings revealing your tech stack, none of which touches your logs at all. That’s a real limitation worth acknowledging rather than pretending you can hunt for something you fundamentally can’t see. But a meaningful subset of reconnaissance does touch your own infrastructure directly, and that subset is worth deliberate hunting attention precisely because it’s some of the earliest possible warning you’ll ever get.

External Scanning Against Your Own Perimeter

Active reconnaissance techniques—port scanning, service enumeration, vulnerability scanning against your externally facing infrastructure—generate real telemetry if you’re logging your perimeter appropriately. A hunt hypothesis worth running periodically: review firewall and perimeter logs for scanning patterns against your external IP ranges, distinguishing between the constant background noise of internet-wide automated scanning (which every organization sees continuously and mostly ignores) and more targeted, methodical enumeration that suggests specific interest in your organization rather than opportunistic mass scanning.

The distinguishing signal here is usually specificity and persistence. Say your perimeter logs show scanning traffic touching dozens of unrelated IP ranges briefly, consistent with mass internet scanning—background noise, not worth chasing individually. Contrast that with scanning traffic that specifically and repeatedly targets your organization’s IP ranges over several days, probing a consistent, narrowing set of ports and services each time—that pattern suggests deliberate interest, and it’s worth a closer look, including checking whether any of the probed services actually have known vulnerabilities that would make them a logical next target.

DNS Enumeration and Subdomain Discovery

Attackers doing reconnaissance against your organization frequently attempt to enumerate subdomains—checking for exposed internal systems, forgotten test environments, or misconfigured services that shouldn’t be publicly discoverable at all. If you control your own DNS infrastructure and log queries against it, unusual patterns of subdomain enumeration—a burst of queries for systematically generated or dictionary-based subdomain names, rather than the normal, small set of legitimate subdomains your organization’s own systems query—is a worthwhile hunt hypothesis, and one that occasionally surfaces the exact forgotten, unpatched system an attacker was hoping to find before you find it yourself.

Social Engineering Reconnaissance Leaves a Fainter, But Real Trail

Reconnaissance aimed at social engineering—mapping organizational structure, identifying specific employees to target for phishing—mostly happens on external platforms outside your direct visibility. But it occasionally does touch your own systems: unusual patterns of failed login attempts against a specific, small set of high-value accounts (rather than broad, random credential stuffing) can indicate an attacker has already done enough reconnaissance to identify specific targets and is now testing access, which sits right at the boundary between reconnaissance and the next kill chain stage. A hunt hypothesis distinguishing “broad, random failed logins consistent with generic credential stuffing” from “narrow, repeated failed logins against specifically identified high-value accounts” is worth building, because the second pattern suggests a level of targeting that generic automated attacks don’t typically show.

Treating Reconnaissance Findings as Early Warning, Not Confirmed Threat

A crucial framing point: confirmed reconnaissance activity against your organization doesn’t mean an intrusion is guaranteed to follow, and treating every scan as an imminent attack leads to alert fatigue and wasted response effort just as surely as ignoring it entirely does. The right response to confirmed, targeted reconnaissance is usually heightened attention rather than full incident response—tightening monitoring on the specific systems or accounts that were probed, checking whether any probed vulnerabilities are actually patched, and treating the finding as a prioritization signal for near-term hunting rather than a confirmed compromise requiring immediate escalation.

Building This Into a Standing, Low-Frequency Hunt

Reconnaissance hunting doesn’t need to run continuously—it’s well suited to a periodic, standing hunt cadence (say, monthly) rather than constant real-time monitoring, since the signal here is usually about pattern and persistence over days rather than a single moment. Building it as a scheduled, recurring hunt rather than a one-off exercise ensures this genuinely early-warning stage doesn’t get permanently deprioritized in favor of the later, more obviously urgent stages of the kill chain.

Build an early-warning threshold

Baseline scanning by source, destination, port breadth, rate, and recurrence. Raise priority when activity concentrates on unusual assets, aligns with brand impersonation or phishing preparation, or is followed by authentication or exploitation attempts. Preserve the distinction between targeted reconnaissance and confirmed compromise.

Reconnaissance hunting rarely proves malicious intent. Its value is earlier context: better monitoring, faster triage, and a record of interest before later activity occurs.