Pre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These activities focus on reducing an organization's attack surface, identify adversarial preparation efforts, and increase the difficulty for attackers to conduct successful operations. This mitigation can be implemented through the following measures: Limit Information Exposure: - Regularly audit and sanitize publicly available data, including job posts, websites, and social media. - Use tools like OSINT monitoring platforms (e.g., SpiderFoot, Recon-ng) to identify leaked information. Protect Domain and DNS Infrastructure: - Enable DNSSEC and use WHOIS privacy protection. - Monitor for domain hijacking or lookalike domains using services like RiskIQ or Domain…
MITRE mitigation sourceAdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Search Open Technical Databases
Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans. Adversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
Observed actors
Correlated CTI and IR reports
1200km CTI repository · explicit report mentionPioneer Kitten (Fox Kitten, Lemon Sandstorm, UNC757) – Actor Deep Research
Israel Threat Actors CTI · explicit report mentionAPT41 Targeting Pharmaceutical Sector Log4Shell to Domain Compromise
1200km Medium · authored report mention
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
OSINT & Reconnaissance · Governed topic match · 87/100Authority, ethics, privacy, safety, and operational security
OSINT & Reconnaissance · Governed topic match · 78/100Search engines, web archives, public records, and documents
OSINT & Reconnaissance · Governed topic match · 78/100Domain, DNS, RDAP, certificate transparency, and routing research
OSINT & Reconnaissance · Governed topic match · 75/100Module 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · Governed topic match · 69/100Public code, packages, cloud artifacts, documents, and exposed secrets
OSINT & Reconnaissance · Governed topic match · 66/100AI-assisted OSINT with bounded tools, citations, and human review
OSINT & Reconnaissance · Governed topic match · 66/100Module 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · Governed topic match · 63/100Images, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · Governed topic match · 60/100Module 4 — Collection Sources
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100
MITRE mitigations
MITRE detection strategies and analytics
- AN1992 · Analytic 1992 — Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.