MITRE ATT&CK Enterprise techniques whose primary tactic is Reconnaissance: detection with open-source tooling and cyber range exercises.
Detecting T1589 Gather Victim Identity Information, using telemetry such as Network Traffic Content. Covers its 3 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1590 Gather Victim Network Information. Covers its 6 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1591 Gather Victim Org Information. Covers its 4 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1592 Gather Victim Host Information, using telemetry such as Response Content. Covers its 4 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1593 Search Open Websites/Domains. Covers its 3 sub-techniques, the ATT&CK mitigations Audit and Application Developer Guidance, and how to rehearse the detection in a cyber range.
Detecting T1594 Search Victim-Owned Websites, using telemetry such as Application Log Content. Covers the ATT&CK mitigation Pre-compromise and how to rehearse the detection in a cyber range.
Detecting T1595 Active Scanning, using telemetry such as Network Traffic Content and Network Traffic Flow. Covers its 3 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1596 Search Open Technical Databases. Covers its 5 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1597 Search Closed Sources. Covers its 2 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1598 Phishing for Information, using telemetry such as Network Traffic Content, Application Log Content and Network Traffic Flow. Covers its 4 sub-techniques, the ATT&CK mitigations Software Configuration and User Training, and how to rehearse the detection in a cyber range.
Detecting T1681 Search Threat Vendor Data. Covers the ATT&CK mitigation Pre-compromise and how to rehearse the detection in a cyber range.
Detecting T1682 Query Public AI Services. Covers the ATT&CK mitigation Pre-compromise and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.