{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1596","id":"T1596","name":"Search Open Technical Databases","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1596","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"4399c7c922e758a3fbafb5edad60ee00a3d3705f4d13c0724e6e995d028c66ad","description":"Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)\n\nAdversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1596","external_id":"T1596"},{"source_name":"Circl Passive DNS","description":"CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.","url":"https://www.circl.lu/services/passive-dns/"},{"source_name":"DNS Dumpster","description":"Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.","url":"https://dnsdumpster.com/"},{"source_name":"Medium SSL Cert","description":"Jain, M. (2019, September 16). Export & Download — SSL Certificate from Server (Site URL). Retrieved October 20, 2020.","url":"https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2"},{"source_name":"WHOIS","description":"NTT America. (n.d.). Whois Lookup. Retrieved November 17, 2024.","url":"https://who.is/"},{"source_name":"Shodan","description":"Shodan. (n.d.). Shodan. Retrieved October 20, 2020.","url":"https://shodan.io"},{"source_name":"SSLShopper Lookup","description":"SSL Shopper. (n.d.). SSL Checker. Retrieved October 20, 2020.","url":"https://www.sslshopper.com/ssl-checker.html"},{"source_name":"DigitalShadows CDN","description":"Swisscom & Digital Shadows. (2017, September 6). Content Delivery Networks (CDNs) Can Leave You Exposed – How You Might Be Affected And What You Can Do About It. Retrieved October 20, 2020.","url":"https://www.digitalshadows.com/blog-and-research/content-delivery-networks-cdns-can-leave-you-exposed-how-you-might-be-affected-and-what-you-can-do-about-it/"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","parent":null,"children":[{"key":"enterprise/T1596.001","id":"T1596.001","name":"DNS/Passive DNS","page":"techniques/enterprise/T1596.001/"},{"key":"enterprise/T1596.002","id":"T1596.002","name":"WHOIS","page":"techniques/enterprise/T1596.002/"},{"key":"enterprise/T1596.003","id":"T1596.003","name":"Digital Certificates","page":"techniques/enterprise/T1596.003/"},{"key":"enterprise/T1596.004","id":"T1596.004","name":"CDNs","page":"techniques/enterprise/T1596.004/"},{"key":"enterprise/T1596.005","id":"T1596.005","name":"Scan Databases","page":"techniques/enterprise/T1596.005/"}],"telemetry":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input","category":"External context and intelligence","description":"External observations that may contextualize adversary preparation but do not show access to a victim.","collection_focus":"Retain source provenance, confidence and temporal bounds; explicitly label observations outside victim visibility.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["indicator","source_record","confidence","victim_access_observed"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input","category":"External context and intelligence","description":"Audit records controlled by an external provider that may only be available through an authorized disclosure or account-owner export.","collection_focus":"Document legal/account-owner access and provider coverage before ingestion. Preserve original IDs, timestamps and disclosure limits; do not seek unauthorized access.","providers":[{"name":"Authorized provider/account-owner audit exports","scope":"Available only with the provider or account owner’s lawful access and supported export.","source_id":"cloudtrail"},{"name":"CloudTrail in an owned lab account","scope":"A concrete lab-side example; it does not grant access to adversary-controlled accounts.","source_id":"cloudtrail"}],"configuration":["Establish the authorized account, record owner and export mechanism before collection. Without access, mark this input unavailable rather than simulating defender visibility.","Preserve source event IDs, account/resource IDs, original timestamps and the authorized disclosure/export record.","Document which events the provider actually exposes and compare delivered records to the request scope. Keep lab-side actions separate from victim-side evidence."],"configuration_example":null,"required_fields":["provider_record_id","access_basis","action","victim_network_observation"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Customer-accessible audit APIs do not expose arbitrary third-party accounts. A synthetic provider event cannot establish access, attribution or detection coverage in a real investigation.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."}],"detection":{"key":"enterprise/T1596","id":"T1596","name":"Search Open Technical Databases","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1596","technique_page":"techniques/enterprise/T1596/","page":"detections/enterprise/T1596/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0860","name":"Detection of Search Open Technical Databases","url":"https://attack.mitre.org/detectionstrategies/DET0860","stix_id":"x-mitre-detection-strategy--dc9fa05f-7e98-41ef-9d40-21fd1425f5d5","relationship_id":"relationship--86f465bd-40a5-49c5-8cd3-b59115e21c0a","description":"","analytics":[{"id":"AN1992","name":"Analytic 1992","guidance":"Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0860#AN1992","platforms":["PRE"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","tag":"Proposed: External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input"},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","tag":"Proposed: Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input"}],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used large language models (LLMs) to assist in script development and deployment.(Citation: MSFT-AI)(Citation: OpenAI-CTI) ","relationship_id":"relationship--0b98a770-5e21-467a-a2c4-adbad2c04e16","references":[{"source_name":"MSFT-AI","description":"Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"},{"source_name":"OpenAI-CTI","description":"OpenAI. (2024, February 14). Disrupting malicious uses of AI by state-affiliated threat actors. Retrieved September 12, 2024.","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has used LLMs to better understand publicly reported vulnerabilities.(Citation: MSFT-AI)(Citation: OpenAI-CTI) ","relationship_id":"relationship--7e464bad-e53e-4300-9bff-62d91fb9bf00","references":[{"source_name":"MSFT-AI","description":"Microsoft Threat Intelligence. (2024, February 14). Staying ahead of threat actors in the age of AI. Retrieved March 11, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"},{"source_name":"OpenAI-CTI","description":"OpenAI. (2024, February 14). Disrupting malicious uses of AI by state-affiliated threat actors. Retrieved September 12, 2024.","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.","relationship_id":"relationship--36e1fe73-44dd-48d0-b213-987f085a47f1","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1593":"/ttp-simulation/techniques/enterprise/T1593/","T1583":"/ttp-simulation/techniques/enterprise/T1583/","T1584":"/ttp-simulation/techniques/enterprise/T1584/","T1133":"/ttp-simulation/techniques/enterprise/T1133/","T1199":"/ttp-simulation/techniques/enterprise/T1199/","T1596":"/ttp-simulation/techniques/enterprise/T1596/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1596","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}}]}}