Network Topology Reconnaissance (T1590.004) and Defenses

Adversaries may gather information about a victim's network topology. MITRE lists this under Reconnaissance with platform PRE. Topology covers the physical and logical arrangement of external facing and internal networks, including gateways, routers, and other infrastructure. The page was last modified in May 2026.

How attackers use it

MITRE says collection can be direct, through active scanning or phishing for information, or indirect, through data sets such as the victim's own websites.

The results can support further searches of open technical databases and websites, the acquisition or compromise of infrastructure, and initial access through external remote services.

How to detect it

MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.

Scanning shows up in firewall and perimeter logs as sweeps of addresses and ports from one source. Phishing for information shows up in mail reports.

How to reduce the risk

• MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
• Keep network diagrams, assessment reports, and device details off public pages and out of public documents.
• Check that documents shared with customers and vendors do not include more diagram detail than needed.
• Limit banners and error pages on edge devices that reveal model or version.
• Segment internal networks, so topology knowledge does not equal reach.

Quick check

Sources

• MITRE ATT&CK, Network Topology (T1590.004): https://attack.mitre.org/techniques/T1590/004