{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1592","id":"T1592","name":"Gather Victim Host Information","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1592","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"39477e59f651c159d6ace5adb8e9a34813a4bf1e8d9b269ce9ff321940de9b03","description":"Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).\n\nAdversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).\n\nAdversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.(Citation: TrellixQakbot)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1592","external_id":"T1592"},{"source_name":"ATT ScanBox","description":"Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"},{"source_name":"TrellixQakbot","description":"Pham Duy Phuc, John Fokker J.E., Alejandro Houspanossian and Mathanraj Thangaraju. (2023, March 7). Qakbot Evolves to OneNote Malware Distribution. Retrieved August 1, 2024.","url":"https://www.trellix.com/blogs/research/qakbot-evolves-to-onenote-malware-distribution/"},{"source_name":"ThreatConnect Infrastructure Dec 2020","description":"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.","url":"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1592.001","id":"T1592.001","name":"Hardware","page":"techniques/enterprise/T1592.001/"},{"key":"enterprise/T1592.002","id":"T1592.002","name":"Software","page":"techniques/enterprise/T1592.002/"},{"key":"enterprise/T1592.003","id":"T1592.003","name":"Firmware","page":"techniques/enterprise/T1592.003/"},{"key":"enterprise/T1592.004","id":"T1592.004","name":"Client Configurations","page":"techniques/enterprise/T1592.004/"}],"telemetry":[{"id":"DC0104","name":"Response Content","page":"telemetry/DC0104/","kind":"attack_component","category":"Network and protocol telemetry","description":"Content returned by a queried service, such as an HTTP response body or banner.","collection_focus":"Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["service","response_excerpt","content_type","body_truncated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1592","id":"T1592","name":"Gather Victim Host Information","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1592","technique_page":"techniques/enterprise/T1592/","page":"detections/enterprise/T1592/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0826","name":"Detection of Gather Victim Host Information","url":"https://attack.mitre.org/detectionstrategies/DET0826","stix_id":"x-mitre-detection-strategy--b172a0fa-e429-4e6e-89b4-54dcfcefa893","relationship_id":"relationship--01dfec4e-1980-4346-8619-c6553727d83d","description":"","analytics":[{"id":"AN1958","name":"Analytic 1958","guidance":"Internet scanners may be used to look for patterns associated with malicious content designed to collect host information from visitors.\nMuch of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0826#AN1958","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0104","component":"Response Content","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN1958","source_url":"https://attack.mitre.org/detectionstrategies/DET0826#AN1958","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0104/"}]}]}],"telemetry_references":[{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has conducted pre-compromise reconnaissance for victim host information.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--5fc4e1c8-69f4-4bf6-bcd3-6a02e9547f61","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.","relationship_id":"relationship--9a433652-118d-428e-8ff0-551543a062a7","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1595":"/ttp-simulation/techniques/enterprise/T1595/","T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1593.001":"/ttp-simulation/techniques/enterprise/T1593.001/","T1594":"/ttp-simulation/techniques/enterprise/T1594/","T1593":"/ttp-simulation/techniques/enterprise/T1593/","T1596":"/ttp-simulation/techniques/enterprise/T1596/","T1587":"/ttp-simulation/techniques/enterprise/T1587/","T1588":"/ttp-simulation/techniques/enterprise/T1588/","T1195":"/ttp-simulation/techniques/enterprise/T1195/","T1133":"/ttp-simulation/techniques/enterprise/T1133/","T1592":"/ttp-simulation/techniques/enterprise/T1592/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1592","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}}]}}