TA0043 · RECONNAISSANCE
Search Open Technical Databases
Shodan, Censys, certificate transparency, WHOIS, and DNS records used to map external attack surface.
Detect it with
Run the same queries yourself on a schedule. Anything you find, they already found.
Why it matters on shift
Search Open Technical Databases is one of the concrete ways adversaries achieve reconnaissance. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After reconnaissance, the next tactic is usually Resource Development. Search your telemetry for the transition before closing the ticket.
5 sub-techniques
How it shows up in practice
- T1596.001
DNS/Passive DNS
Adversaries may search DNS data for information about victims that can be used during targeting.
- T1596.002
WHOIS
Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names.
- T1596.003
Digital Certificates
Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content.
- T1596.004
CDNs
Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers.
- T1596.005
Scan Databases
Adversaries may search within public scan databases for information about victims that can be used during targeting.
Kill-chain context