Reconnaissance

Harvesting employee names, email formats, and credentials from breach dumps and social platforms.

Detect it with
Monitor credential-leak feeds for corporate domains; watch for authentication attempts against accounts that never existed.

Adversaries may gather information about the victim's networks that can be used during targeting.

Detect it with
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may gather information about the victim's organization that can be used during targeting.

Detect it with
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Collecting hardware, software, and configuration details about hosts through banners, headers, and public documents.

Detect it with
Low signal. Reduce exposure instead: strip version banners, trim verbose error pages, scrub document metadata.

Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.

Detect it with
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Adversaries may search websites owned by the victim for information that can be used during targeting.

Detect it with
Monitor for suspicious network traffic that could be indicative of adversary reconnaissance, such as rapid successions of requests indicative of web crawling and/or large quantities of requests originating from a single source (especially if the source is known to be associated…

Port scans, vulnerability scans, and wordlist-driven directory brute forcing against hosts the target owns.

Detect it with
Edge firewall denies from a single source across many ports; 404 floods in web server logs with scanner user-agents.

Shodan, Censys, certificate transparency, WHOIS, and DNS records used to map external attack surface.

Detect it with
Run the same queries yourself on a schedule. Anything you find, they already found.

Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting.

Detect it with
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Messages designed to elicit information rather than deliver a payload — vendor verification, IT survey, HR pretext.

Detect it with
User reports; mail gateway rules for newly registered lookalike domains and reply-to mismatches.