1200KM / simulation
Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s…
Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations.
Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.[Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023] Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.[Sentinel One Contagious Interview ClickFix September 2025]
This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.
Official technique definition · Open in the interactive matrix
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.
proposed-external-intelligence-context-only collection page — Retain source provenance, confidence and temporal bounds; explicitly label observations outside victim visibility.
Required normalized fields: indicator, source_record, confidence, victim_access_observed.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "proposed-external-intelligence-context-only",
"collector": "illustrative-lab-collector",
"observation": {
"indicator": "lab.example.test",
"source_record": "lab-feed-1",
"confidence": "context_only",
"victim_access_observed": false
}
}Visibility limits: Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.
proposed-provider-side-audit-if-lawfully-available collection page — Document legal/account-owner access and provider coverage before ingestion. Preserve original IDs, timestamps and disclosure limits; do not seek unauthorized access.
Required normalized fields: provider_record_id, access_basis, action, victim_network_observation.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "proposed-provider-side-audit-if-lawfully-available",
"collector": "illustrative-lab-collector",
"observation": {
"provider_record_id": "lab-disclosure-1",
"access_basis": "authorized_test_account_export",
"action": "account_created",
"victim_network_observation": false
}
}Visibility limits: Customer-accessible audit APIs do not expose arbitrary third-party accounts. A synthetic provider event cannot establish access, attribution or detection coverage in a real investigation.
Open the dedicated detection workspace · Existing query engineering
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.
Platforms: PRE.
No structured log-source mapping supplied by this analytic.
No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.
No exact technique-specific Atlas model is present for T1681 in the selected source snapshot. The following is a design worksheet, not a newly validated model.
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
No reviewed lab-tool association is selected for this exact technique. This is a curation gap, not a statement that no tool can implement the behavior.
Atomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Search Threat Vendor Data, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on designing defenses that are not reliant on atomic indicators.
No reviewed association in this snapshot.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.