Mapped, Measured, and Marked: How Adversaries Spend the 72 Hours Before They Attack

Most breach narratives begin at the moment of initial access — the phishing link clicked, the exploited vulnerability, the compromised credential used for the first time. What those narratives rarely capture is the period that precedes that moment: the hours or days during which an adversary quietly assembles a detailed picture of the target environment, validates their intended attack path, and confirms that the conditions for success are in place.

For defenders, this reconnaissance window represents one of the highest-value intervention opportunities in the entire attack lifecycle. Attackers operating during this phase are, by definition, generating observable signals. They are touching infrastructure, querying services, and interacting with systems in ways that — if monitored appropriately — are distinguishable from legitimate traffic. The challenge is knowing what to look for.

What follows is a phase-by-phase breakdown of the techniques adversaries commonly employ in the 72 hours before a targeted attack, paired with the specific indicators defenders can use to detect and disrupt each stage.

Phase 1: Passive Footprinting (Hours 0–24)

The earliest phase of adversary reconnaissance involves no direct interaction with the target's infrastructure. Attackers at this stage are querying publicly available data sources to build a baseline understanding of the organization's external surface.

What attackers are doing:

• Harvesting employee names, titles, and email formats from LinkedIn, corporate websites, and conference speaker rosters to construct targeted phishing lists or credential stuffing inputs
• Querying WHOIS records, DNS registrar data, and certificate transparency logs to enumerate domains, subdomains, and associated IP ranges
• Searching Shodan, Censys, and similar internet-scanning platforms for exposed services, open ports, and banner information that reveals software versions and configurations
• Reviewing job postings on LinkedIn, Indeed, and Glassdoor — a frequently underestimated intelligence source that reveals specific technologies in use, named vendors, and security tool choices
• Searching GitHub, GitLab, and Pastebin for inadvertently committed credentials, API keys, internal hostnames, or configuration files associated with the target organization

What defenders can detect:

Passive footprinting is, by design, difficult to observe directly — the attacker is not touching your systems. However, certain secondary signals are actionable. Certificate transparency log monitoring services (several of which are available to US organizations at no cost) can alert on newly issued certificates for domains resembling your own, which may indicate an attacker preparing a lookalike phishing infrastructure. Periodic searches of code repositories for your organization's domain names and internal naming conventions can surface leaked credentials before they are operationalized.

Phase 2: Active Network Reconnaissance (Hours 12–48)

As passive intelligence gathering matures, adversaries typically transition to active probing — direct interaction with externally accessible systems intended to map services, validate vulnerabilities, and identify potential entry points.

What attackers are doing:

• Conducting port scans against identified IP ranges, often using distributed scanning infrastructure or commercial VPN exit nodes to avoid triggering IP-based blocklists
• Performing service enumeration against exposed ports to confirm software versions, authentication mechanisms, and protocol configurations
• Probing web applications for common vulnerability classes — misconfigured authentication endpoints, exposed administrative interfaces, outdated CMS installations — using both automated scanners and manual validation
• Testing email security controls by sending probe messages designed to assess SPF, DKIM, and DMARC enforcement without triggering content-based filters
• Querying exposed APIs to map endpoint structures and test for authentication bypass or excessive data exposure

What defenders can detect:

Active reconnaissance produces considerably more observable evidence. Firewall and network perimeter logs frequently capture scanning activity, particularly when adversaries probe non-standard ports or attempt connections to services that are not publicly advertised. Establishing baseline traffic profiles for your external-facing infrastructure makes anomalous probe activity significantly easier to identify. Web application firewalls and honeypot services — lightweight fake services deployed on unused ports or subdomains — are particularly effective at surfacing reconnaissance activity, since legitimate users have no reason to interact with them.

Authentication logs on internet-facing systems deserve close attention during this phase. A pattern of failed login attempts across multiple accounts, particularly using formats consistent with your organization's email convention, is a strong indicator that credential stuffing or password spraying has begun.

Phase 3: Target Validation and Attack Path Confirmation (Hours 36–72)

In the final phase before an attack launches, adversaries shift from broad mapping to precise validation. They are confirming that specific vulnerabilities exist as expected, that intended attack paths remain viable, and that detection controls are not positioned to interrupt their planned actions.

What attackers are doing:

• Conducting low-and-slow validation probes against identified vulnerabilities — single, carefully spaced requests designed to confirm exploitability without triggering rate-based detection
• Testing credential validity against external-facing services such as VPN portals, webmail, or cloud application login pages using harvested or purchased credentials
• Enumerating cloud storage resources (S3 buckets, Azure Blob containers) associated with the target organization for publicly accessible sensitive data
• Reviewing the target's public-facing DNS records for recently added or modified entries that might indicate infrastructure changes affecting their planned attack path
• In some cases, establishing initial low-privilege access via a previously compromised third-party system to conduct internal reconnaissance before the primary attack begins

What defenders can detect:

This phase is where attentive defenders have their best opportunity to intercept an attack in progress. Credential validation attempts against VPN and SSO portals generate authentication log entries that, when analyzed in aggregate, reveal patterns inconsistent with legitimate user behavior — particularly attempts outside normal business hours or from geographic regions not associated with your workforce.

Cloud storage enumeration attempts are logged by all major US cloud providers. Enabling and regularly reviewing those logs — specifically for access attempts from unfamiliar IP addresses or requests for bucket names that follow predictable naming conventions — can surface attacker activity before any data is accessed.

External threat intelligence feeds and dark web monitoring services can also provide advance warning during this phase. Adversaries who have completed their reconnaissance and are preparing to launch sometimes discuss targets in closed forums, and US organizations in sectors including healthcare, financial services, and critical infrastructure are frequently named in such communications before attacks materialize.

Disrupting the Reconnaissance Cycle

The tactical value of understanding adversary reconnaissance behavior lies in the disruption opportunities it creates. Defenders who detect footprinting activity can proactively reduce their exposed surface — removing inadvertently published data, hardening externally accessible services, and increasing monitoring sensitivity on likely attack vectors — before the adversary is ready to act.

Even when specific attacker activity is not directly observed, the defensive posture improvements that reconnaissance awareness motivates are independently valuable. Regular external attack surface assessments, conducted from the perspective of an adversary with no prior knowledge of your environment, consistently surface exposures that internal teams have normalized or overlooked.

The 72 hours before an attack is not dead time. For defenders who know what to watch for, it is the window in which the outcome of the breach can still be determined.