What is discovery in MITRE ATT&CK?
Discovery is the attacker, now inside, finding out what your network contains: which hosts exist, which services they offer, which shares hold files, who the administrators are and where the backups are. Typical techniques are scanning internal address ranges, listing network shares, querying the directory and reading the configuration of the machine they are on. Unlike reconnaissance from outside, internal discovery crosses your network, which makes it one of the most visible stages: one host suddenly connecting to many internal addresses on SMB, RDP or database ports. Directory queries show up in identity logs rather than to a flow sensor. Segmentation limits what discovery can reach. NetSenX flags internal scanning on every plan, Free included, and from the Pro plan links it to the sessions that follow.