MITRE ATLAS 2026.09 / technique reference
AML.T0089
Enterprise Environment Discovery
MITRE source definition
Adversaries may discover configurations, conditions, relationships, activity, and other characteristics of an enterprise environment. This may include system and network configuration; active connections, processes, windows, and users; permissions, trust relationships, and policy settings; installed defensive or backup capabilities; network traffic; browser and registry information; or environmental properties such as location, language, time, connectivity, virtualization, debugging, and sandbox indicators.
Adversaries may query or passively observe this information to understand how the environment is configured and operating, identify access paths or security controls, detect monitoring or analysis, and select or adapt subsequent actions.
See the ATT&CK Discovery tactic for techniques describing specific environmental characteristics and discovery mechanisms.
Source modified 2026-08-31. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.
Parent, sub-techniques and ATT&CK references
No explicit relationship in this pinned source.
Source-backed defensive context
MITRE mitigations
No explicit relationship in this pinned source.
MITRE case studies
- AML.CS0036 AIKatz: Attacking LLM Desktop Applications · Exercise
- AML.CS0068 Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure · Incident
- AML.CS0069 GTG-1002 Claude Code Espionage Campaign · Incident
These are explicit source relationships, not independently reproduced incidents or validated detection coverage.
Simulation and telemetry boundary
This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.
For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.
Provenance and attribution
Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0
Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.
No explicit relationship in this pinned source.