{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1590","id":"T1590","name":"Gather Victim Network Information","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1590","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"594499183bf777f180a6bca121e917144c17f9fde4360025663e1edf921402ab","description":"Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1590","external_id":"T1590"},{"source_name":"Circl Passive DNS","description":"CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.","url":"https://www.circl.lu/services/passive-dns/"},{"source_name":"DNS Dumpster","description":"Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.","url":"https://dnsdumpster.com/"},{"source_name":"WHOIS","description":"NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.","url":"https://who.is/"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","parent":null,"children":[{"key":"enterprise/T1590.001","id":"T1590.001","name":"Domain Properties","page":"techniques/enterprise/T1590.001/"},{"key":"enterprise/T1590.002","id":"T1590.002","name":"DNS","page":"techniques/enterprise/T1590.002/"},{"key":"enterprise/T1590.003","id":"T1590.003","name":"Network Trust Dependencies","page":"techniques/enterprise/T1590.003/"},{"key":"enterprise/T1590.004","id":"T1590.004","name":"Network Topology","page":"techniques/enterprise/T1590.004/"},{"key":"enterprise/T1590.005","id":"T1590.005","name":"IP Addresses","page":"techniques/enterprise/T1590.005/"},{"key":"enterprise/T1590.006","id":"T1590.006","name":"Network Security Appliances","page":"techniques/enterprise/T1590.006/"}],"telemetry":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input","category":"External context and intelligence","description":"External observations that may contextualize adversary preparation but do not show access to a victim.","collection_focus":"Retain source provenance, confidence and temporal bounds; explicitly label observations outside victim visibility.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["indicator","source_record","confidence","victim_access_observed"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input","category":"External context and intelligence","description":"Audit records controlled by an external provider that may only be available through an authorized disclosure or account-owner export.","collection_focus":"Document legal/account-owner access and provider coverage before ingestion. Preserve original IDs, timestamps and disclosure limits; do not seek unauthorized access.","providers":[{"name":"Authorized provider/account-owner audit exports","scope":"Available only with the provider or account owner’s lawful access and supported export.","source_id":"cloudtrail"},{"name":"CloudTrail in an owned lab account","scope":"A concrete lab-side example; it does not grant access to adversary-controlled accounts.","source_id":"cloudtrail"}],"configuration":["Establish the authorized account, record owner and export mechanism before collection. Without access, mark this input unavailable rather than simulating defender visibility.","Preserve source event IDs, account/resource IDs, original timestamps and the authorized disclosure/export record.","Document which events the provider actually exposes and compare delivered records to the request scope. Keep lab-side actions separate from victim-side evidence."],"configuration_example":null,"required_fields":["provider_record_id","access_basis","action","victim_network_observation"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Customer-accessible audit APIs do not expose arbitrary third-party accounts. A synthetic provider event cannot establish access, attribution or detection coverage in a real investigation.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."}],"detection":{"key":"enterprise/T1590","id":"T1590","name":"Gather Victim Network Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1590","technique_page":"techniques/enterprise/T1590/","page":"detections/enterprise/T1590/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d","title":"PUA - Advanced IP/Port Scanner Update Check","status":"test","level":"medium","logsource":{"category":"proxy"},"data_path":"data/detection-rules/1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml","author":"Axel Olsson","kind":"sigma"},{"id":"ec82e2a5-81ea-4211-a1f8-37a0286df2c2","title":"Suspicious DNS Query for IP Lookup Service APIs","status":"test","level":"medium","logsource":{"product":"windows","category":"dns_query"},"data_path":"data/detection-rules/ec82e2a5-81ea-4211-a1f8-37a0286df2c2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml","author":"Brandon George (blog post), Thomas Patzke","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1590-1","technique_id":"T1590","title":"T1590 Gather Victim Network Information","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#reconnaissance","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":27,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L27","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"553d5c85a607d1391ab02e61ce2ecdc62ae58f1d5d4acf11feaab07e10ff6c0f","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(dns_zone_transfer_request OR repeated_public_dns_enumeration) AND source_ip NOT_IN approved_dns_admins -> ALERT","log_sources":[{"title":"Authoritative DNS Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#64-authoritative-dns-logs"},{"title":"Network Intrusion Detection Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#61-network-intrusion-detection-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1590-1","technique_id":"T1590","title":"DNS enumeration or zone-transfer attempts — T1590 Gather Victim Network Information","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#dns-enumeration","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":26,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L26","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"c4c0c8cfc2beb152837b413c0ed169d86764e48eadcb7e3a0bd6903c2b367564","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"requesting client.","expected_behavior":"clients request a limited distribution of record types and names.","deviation":"rare query types, unusually broad name coverage, or a sudden increase in authoritative queries.","anomaly_types":[{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"},{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"}],"log_sources":[{"title":"Authoritative DNS Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#64-authoritative-dns-logs"},{"title":"DNS Resolver Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#63-dns-resolver-logs"}],"context_references":[{"title":"Volt Typhoon joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fbi-aa24-038a-volt-typhoon.pdf"},{"title":"original source","url":"https://www.fbi.gov/file-repository/cyber-alerts/prc-state-sponsored-actors-compromise-and-maintain-persistent-access-to-u-s-critical-infrastructure.pdf"}]}],"anomaly_types":[{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"},{"title":"Volume Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#15-volume-anomaly"}],"strategies":[{"id":"DET0869","name":"Detection of Gather Victim Network Information","url":"https://attack.mitre.org/detectionstrategies/DET0869","stix_id":"x-mitre-detection-strategy--9031c511-d7ff-410e-9144-d3afee390210","relationship_id":"relationship--c328babb-055f-447f-b5be-cdf1b67bdfbf","description":"","analytics":[{"id":"AN2001","name":"Analytic 2001","guidance":"Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0869#AN2001","platforms":["PRE"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","tag":"Proposed: External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input"},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","tag":"Proposed: Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input"}],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0119","name":"Indrik Spider","url":"https://attack.mitre.org/groups/G0119","kind":"intrusion-set","description":"[Indrik Spider](https://attack.mitre.org/groups/G0119) has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. [Indrik Spider](https://attack.mitre.org/groups/G0119) has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc.(Citation: Mandiant_UNC2165)","relationship_id":"relationship--656f1790-2ea7-4690-9d72-0371b90bdafd","references":[{"source_name":"Mandiant_UNC2165","description":"Mandiant Intelligence. (2022, June 2). To HADES and Back: UNC2165 Shifts to LOCKBIT to Evade Sanctions. Retrieved July 29, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.(Citation: Volexity Exchange Marauder March 2021)","relationship_id":"relationship--73e8d90b-62e2-4ea2-b66c-2c94297bdcc5","references":[{"source_name":"Volexity Exchange Marauder March 2021","description":"Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--34558338-caef-4e28-8512-8f42746dd256","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.","relationship_id":"relationship--78968b8c-61ed-44d9-835c-05eb5b2ab169","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1595":"/ttp-simulation/techniques/enterprise/T1595/","T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1596":"/ttp-simulation/techniques/enterprise/T1596/","T1593":"/ttp-simulation/techniques/enterprise/T1593/","T1583":"/ttp-simulation/techniques/enterprise/T1583/","T1584":"/ttp-simulation/techniques/enterprise/T1584/","T1199":"/ttp-simulation/techniques/enterprise/T1199/","T1590":"/ttp-simulation/techniques/enterprise/T1590/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1590","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}}]}}