mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1589 - Gather Victim Identity Information
How adversaries collect usernames, email addresses, and names to build targets for phishing and credential stuffing.
Read more
Back to mitre-attack
Reconnaissance
Posts
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1590 - Gather Victim Network Information
How attackers map perimeter infrastructure, DNS records, and network topology to identify entry points.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1591 - Gather Victim Org Information
How adversaries research organizational structures, physical locations, and business relationships to tailor their attacks.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1592 - Gather Victim Host Information
How adversaries collect technical details about hardware, software, and firmware to identify exploitable vulnerabilities.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1593 - Search Open Websites & Domains
How adversaries leverage social media, search engines, and code repositories to gather intelligence without direct contact.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1594 - Search Victim-Owned Websites
How adversaries scrape and browse a target organization's own website to find hidden directories and operational clues.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1595 - Active Scanning
A deep dive into MITRE ATT&CK Technique T1595 (Active Scanning), exploring how attackers probe networks to map out hosts and vulnerabilities.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1596 - Search Open Technical Databases
How adversaries query WHOIS, DNS, CT logs, and scan databases to map an organization's attack surface passively.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1597 - Search Closed Sources
How adversaries purchase credentials and threat intelligence from dark web markets and closed forums.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1598 - Phishing for Information
How adversaries use deceptive communication to harvest credentials and organizational details without delivering malware.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1681 - Search Threat Vendor Data
How adversaries monitor public threat reporting to track their own exposure and rotate infrastructure.
Read more
mitre-attackreconnaissancered-teaming
[ATT&CK Series] T1682 - Query Public AI Services
How adversaries use LLMs to synthesize and scale open-source intelligence gathering.
Read more