The implementation of the measures of the joint forces operation to contain and repulse Russian armed aggression in the territory of Donetsk and Luhansk regions, the national security of Ukraine provides a set of multifaceted political, diplomatic, economic, technological, ideological and military measures. Of decisive importance among them are political measures aimed at creating favorable conditions for the state, eliminating existing and potential threats, and localizing them. The experience of conducting combat operations in the Joint Forces operation, namely, the performance of tasks by units of the Armed Forces of Ukraine and other components of the defense forces in stabilization operations while strengthening the protection of the state border, isolating the armed conflict, combating enemy sabotage and reconnaissance groups and illegal armed formations, indicates that that the classical ways of performing tasks are not rational. In preparation for and during active combat operations in order to destabilize the situation, sabotage mobilization measures and the operational deployment of troops, isolate the battlefield, complicate maneuver, disrupt command and control of troops and weapons, rear services, etc. the enemy will carry out large-scale sabotage, reconnaissance and other subversive actions in the zone of responsibility of operational formations (formations). At the same time, illegal armed formations will be organized and operate, which will be involved in carrying out destabilization actions. The article considers a calculation method for searching for enemy sabotage and reconnaissance groups and illegal armed formations in a given area, taking into account the peculiarities of modern armed conflicts and the forces and means involved (used) in this process. Keywords: search, sabotage and reconnaissance group, illegal armed formation of mathematical expectation, probability of an event.