Search Open Technical Databases

T1596

Technique with 5 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.

Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).

Detection rules0

Rules on DetectionCode tagged with T1596 or one of its sub-techniques.

Sigma0

No Sigma rules are mapped to this technique yet.

Splunk0

No Splunk rules are mapped to this technique yet.

Sub-techniques5

ID	Name	Examples
T1596.001	DNS/Passive DNS	0
T1596.002	WHOIS	0
T1596.003	Digital Certificates	0
T1596.004	CDNs	0
T1596.005	Scan Databases	3

Groups2

APT28 Kimsuky

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples2

Groups2

Used by	Procedure example
GroupAPT28	APT28 has used large language models (LLMs) to assist in script development and deployment. MSFT-AI OpenAI-CTI
GroupKimsuky	Kimsuky has used LLMs to better understand publicly reported vulnerabilities. MSFT-AI OpenAI-CTI

References7

Circl Passive DNS Open source
CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.
DNS Dumpster Open source
Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.
DigitalShadows CDN Open source
Swisscom & Digital Shadows. (2017, September 6). Content Delivery Networks (CDNs) Can Leave You Exposed – How You Might Be Affected And What You Can Do About It. Retrieved October 20, 2020.
Medium SSL Cert Open source
Jain, M. (2019, September 16). Export & Download — SSL Certificate from Server (Site URL). Retrieved October 20, 2020.
SSLShopper Lookup Open source
SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020.
Shodan Open source
Shodan. (n.d.). Shodan. Retrieved October 20, 2020.
WHOIS Open source
NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.