TA0043 · RECONNAISSANCE
Gather Victim Host Information
Collecting hardware, software, and configuration details about hosts through banners, headers, and public documents.
Detect it with
Low signal. Reduce exposure instead: strip version banners, trim verbose error pages, scrub document metadata.
Why it matters on shift
Gather Victim Host Information is one of the concrete ways adversaries achieve reconnaissance. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After reconnaissance, the next tactic is usually Resource Development. Search your telemetry for the transition before closing the ticket.
4 sub-techniques
How it shows up in practice
- T1592.001
Hardware
Adversaries may gather information about the victim's host hardware that can be used during targeting.
- T1592.002
Software
Adversaries may gather information about the victim's host software that can be used during targeting.
- T1592.003
Firmware
Adversaries may gather information about the victim's host firmware that can be used during targeting.
- T1592.004
Client Configurations
Adversaries may gather information about the victim's client configurations that can be used during targeting.
Kill-chain context