Pre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These activities focus on reducing an organization's attack surface, identify adversarial preparation efforts, and increase the difficulty for attackers to conduct successful operations. This mitigation can be implemented through the following measures: Limit Information Exposure: - Regularly audit and sanitize publicly available data, including job posts, websites, and social media. - Use tools like OSINT monitoring platforms (e.g., SpiderFoot, Recon-ng) to identify leaked information. Protect Domain and DNS Infrastructure: - Enable DNSSEC and use WHOIS privacy protection. - Monitor for domain hijacking or lookalike domains using services like RiskIQ or Domain…
MITRE mitigation sourceAdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Gather Victim Network Information
Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
OSINT & Reconnaissance · Governed topic match · 75/100Module 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · Governed topic match · 69/100Threat infrastructure, IOC enrichment, campaign pivots, and attribution restraint
OSINT & Reconnaissance · Governed topic match · 66/100Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · Governed topic match · 57/100Search engines, web archives, public records, and documents
OSINT & Reconnaissance · Governed topic match · 57/100AI-assisted OSINT with bounded tools, citations, and human review
OSINT & Reconnaissance · Governed topic match · 57/100Module 10 — Career Path Continuing Education
Cyber Threat Intelligence (CTI) · Governed topic match · 51/100Research governance, authorization, and safety
Vulnerability Research & Exploit Development · Governed topic match · 42/100Authority, ethics, privacy, safety, and operational security
OSINT & Reconnaissance · Tactic learning route · 24/100Module 4 — Collection Sources
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100
MITRE mitigations
MITRE detection strategies and analytics
- AN2001 · Analytic 2001 — Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.