System reconnaissance is the early collection of information about a victim host or network before the main payload runs. Attackers use it to learn basics such as the operating system, domain membership, user privileges, language or locale, installed security tools, and network settings. That information helps them decide which malware module to deliver, which commands will work, and how to avoid detection.
In phishing and script-based attacks, reconnaissance often happens immediately after a malicious file or trusted binary starts execution. A container like an HTA launched through mshta.exe may query system details and then fetch a second-stage payload tailored to the environment. Defenders watch for unusual host-enumeration commands, scripted calls to system APIs, and suspicious mshta.exe activity. Blocking script-capable binaries, limiting local discovery commands, and alerting on early host profiling can interrupt the attack before credential theft or lateral movement begins.