Gather Victim Network Information

T1590

Technique with 6 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).

Detection rules12

Rules on DetectionCode tagged with T1590 or one of its sub-techniques.

Sigma4

Rule	Level	Log source	Technique
PUA - Crassus Execution	high	windows / process_creation	T1590.001
Failed DNS Zone Transfer	medium	windows / NULL	T1590.002
PUA - Advanced IP/Port Scanner Update Check	medium	NULL / proxy	T1590
Suspicious DNS Query for IP Lookup Service APIs	medium	windows / dns_query	T1590

Splunk8

Rule	Type	Risk	Data source	Technique
Cisco ASA - Reconnaissance Command Activity	Anomaly	NULL	Cisco ASA Logs	T1590.001 T1590.005
Cisco IOS XE Reconnaissance Command Activity	Anomaly	NULL	Cisco IOS Logs	T1590
Cisco NVM - Suspicious Network Connection to IP Lookup Service API	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1590.005
Local LLM Framework DNS Query	Hunting	NULL	Sysmon EventID 22	T1590
Wermgr Process Connecting To IP Check Web Services	TTP	NULL	Sysmon EventID 22	T1590.005
Windows DNS Gather Network Info	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1590.002
Windows Gather Victim Network Info Through Ip Check Web Services	Anomaly	NULL	Sysmon EventID 22	T1590.005
Windows WinPEAS PowerShell Script Execution	TTP	NULL	Powershell Script Block Logging 4104	T1590

Sub-techniques6

ID	Name	Examples
T1590.001	Domain Properties	2
T1590.002	DNS	0
T1590.003	Network Trust Dependencies	0
T1590.004	Network Topology	5
T1590.005	IP Addresses	3
T1590.006	Network Security Appliances	2

Groups3

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples3

Groups3

Used by	Procedure example
GroupHAFNIUM	HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment. Volexity Exchange Marauder March 2021
GroupIndrik Spider	Indrik Spider has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. Indrik Spider has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc. Mandiant_UNC2165
GroupVolt Typhoon	Volt Typhoon has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network. CISA AA24-038A PRC Critical Infrastructure February 2024

References3

Circl Passive DNS Open source
CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.
DNS Dumpster Open source
Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
WHOIS Open source
NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.