Technique with 4 sub-techniques.View on attack.mitre.org
Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).
Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors. Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).
Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.
Rules on DetectionCode tagged with T1592 or one of its sub-techniques.
| Rule | Level | Log source | Technique |
|---|---|---|---|
| Linux Recon Indicators | high | linux / process_creation | T1592.004 |
| Access of Sudoers File Content | medium | linux / process_creation | T1592.004 |
| Print History File Contents | medium | linux / process_creation | T1592.004 |
| Rule | Type | Risk | Data source | Technique |
|---|---|---|---|---|
| Recon AVProduct Through Pwh or WMI | TTP | NULL | Powershell Script Block Logging 4104 | T1592 |
| Recon Using WMI Class | Anomaly | NULL | Powershell Script Block Logging 4104 | T1592 |
| System Info Gathering Using Dxdiag Application | Hunting | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 | T1592 |
| Windows Gather Victim Host Information Camera | Anomaly | NULL | Powershell Script Block Logging 4104 | T1592.001 |
| Windows WinPEAS PowerShell Script Execution | TTP | NULL | Powershell Script Block Logging 4104 | T1592.002 T1592.004 |
| WMI Recon Running Process Or Services | Anomaly | NULL | Powershell Script Block Logging 4104 | T1592 |
None recorded.
None recorded.
| Used by | Procedure example |
|---|---|
| GroupVolt Typhoon | Volt Typhoon has conducted pre-compromise reconnaissance for victim host information. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
