Pre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These activities focus on reducing an organization's attack surface, identify adversarial preparation efforts, and increase the difficulty for attackers to conduct successful operations. This mitigation can be implemented through the following measures: Limit Information Exposure: - Regularly audit and sanitize publicly available data, including job posts, websites, and social media. - Use tools like OSINT monitoring platforms (e.g., SpiderFoot, Recon-ng) to identify leaked information. Protect Domain and DNS Infrastructure: - Enable DNSSEC and use WHOIS privacy protection. - Monitor for domain hijacking or lookalike domains using services like RiskIQ or Domain…
MITRE mitigation sourceAdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Threat Intel Vendors
Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Adversaries may search in private threat intelligence vendor data to gather actionable information. Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Cyber Threat Intelligence (CTI) · Governed topic match · 78/100Module 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · Governed topic match · 78/100Module 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · Governed topic match · 66/100Search engines, web archives, public records, and documents
OSINT & Reconnaissance · Governed topic match · 66/100Threat infrastructure, IOC enrichment, campaign pivots, and attribution restraint
OSINT & Reconnaissance · Governed topic match · 66/100Module 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · Governed topic match · 57/100Module 7 — Intelligence Products Sharing
Cyber Threat Intelligence (CTI) · Governed topic match · 57/100Module 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · Governed topic match · 57/100Module 10 — Career Path Continuing Education
Cyber Threat Intelligence (CTI) · Governed topic match · 57/100Intelligence requirements, hypotheses, and collection planning
OSINT & Reconnaissance · Governed topic match · 57/100Weakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · Governed topic match · 48/100Images, video, audio, geolocation, chronolocation, and media verification
OSINT & Reconnaissance · Governed topic match · 48/100
MITRE mitigations
MITRE detection strategies and analytics
- AN1948 · Analytic 1948 — Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.