How attackers map your network before you notice

2 October 2026 · 3 min read

Before an attacker touches your crown jewels, they spend time learning what you have. That reconnaissance phase is quiet and often invisible — unless you know what it looks like.

The first thing an attacker does

After gaining a foothold (a phished user, a compromised laptop, a VPN credential bought online), the first question is: where am I, and what can I reach? The attacker scans the local subnet, often with a tool like nmap or Masscan, looking for open ports. They are particularly interested in port 445 (SMB file shares), 3389 (RDP), 22 (SSH), 3306 (MySQL), and 443 (HTTPS management consoles).

That scan, which takes seconds on a /24 subnet, is normally invisible. Firewalls only block traffic they are told to block. Endpoint agents only flag what they are trained to flag. A port scan to an address that isn't a server simply… goes nowhere.

Where decoys come in

A decoy is a fake system that sits in the scan path but has no legitimate purpose. The moment a scanning tool hits it and tries to log in, or even just completes a TCP handshake, you know something is looking. Unlike a real server that might have an administrator on it at odd hours, nobody should ever touch a decoy.

The sweet spot is to place decoys at the addresses an attacker would expect to find servers: the same /16 as your real infrastructure, on ports that real services in your org use. A decoy NAS at the address right next to your real NAS is almost certain to be found.

What the signal looks like

A real reconnaissance event will touch several ports in a short window, from the same source IP. Kandaro groups those touches into one incident and tells you the source IP, the port sweep pattern, and what the attacker tried next (login attempt, SMB negotiate, Redis query). You see the full story, not a pile of raw events.