Adversaries may gather a victim's IP addresses for targeting. MITRE lists this under Reconnaissance with platform PRE. Public addresses are usually allocated to organizations in blocks or sequential ranges, and the details can show which addresses are in use.
How attackers use it
MITRE says addresses can also reveal organizational size, physical locations, internet service provider, and where and how public facing infrastructure is hosted.
Collection can be direct, through active scanning or phishing for information, or indirect, through open technical databases. The results feed more scanning and searching, the acquisition or compromise of infrastructure, and initial access through external remote services.
IP data answers practical questions. How big is the company? Which cloud or hosting provider does it use? Which addresses answer? An attacker can use the answers to decide where to look for a weak point.
MITRE notes that the information may come from open technical databases. Those are built from internet wide measurement, so the data exists whether or not anyone targets you.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
Scans of your ranges appear in perimeter and firewall logs. Counting distinct destination addresses touched by one source in a short window is a simple way to separate a sweep from normal traffic. Treat the result as context, not a verdict, since internet wide scanning is constant background noise.
A sensible alert counts distinct internal addresses or ports touched by a single external source in a short time. Tune the threshold on a normal week, and expect noise.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Know your own public footprint. Compare what is reachable with what you believe is deployed.
- Close services that do not need to face the internet.
- Put management interfaces behind a VPN or an access broker.
- Review cloud security groups and firewall rules on a schedule.
- Retire addresses and hosts you no longer use.
The demo below shows how an inventory of assets is built from connected sources. A good inventory is the base for everything else in this post, since you cannot close what you do not know about.
Check your own environment
- Do we have a list of every public address we own or use, including cloud?
- Which of them respond on ports we cannot explain?
- Who reviews firewall and cloud rules, and how often?
- When did we last compare an external view against the inventory?
Try it yourself
This walkthrough shows how to build and check an inventory of assets, including the ones nobody remembered to list.
Click through it at your own pace, or open it full screen.
Quick check
What can an IP address reveal beyond reachability?
Organizational size, physical location, internet service provider, and where and how public facing infrastructure is hosted.
Is a scan of your range always an attack?
No. Scanning is common background traffic, so treat it as context and focus on later stages.
Sources
- MITRE ATT&CK, IP Addresses (T1590.005): https://attack.mitre.org/techniques/T1590/005
