Network Security Appliance Recon (T1590.006): What to Know

Adversaries may gather information about a victim's network security appliances. MITRE lists this under Reconnaissance with platform PRE. Appliances include firewalls, content filters, and proxies or bastion hosts. Adversaries may also look for network intrusion detection systems and other defensive appliances.

How attackers use it

MITRE says the information can be collected directly, through active scanning or phishing for information, or indirectly from data sets such as the victim's own websites.

What the adversary learns can lead to further searches of open technical databases, to acquiring or developing capabilities, and to initial access through external remote services.

How to detect it

MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.

Probing of perimeter devices appears in the devices' own logs. Review connection attempts to management ports from unexpected sources.

How to reduce the risk

• MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
• Do not publish vendor and product details of your security stack on job postings and public pages unless there is a reason.
• Remove management interfaces from the public internet.
• Reduce version banners on devices where the product allows it.
• Keep appliances patched, since knowing the product helps an attacker only if a known flaw is open.

Quick check

Sources

• MITRE ATT&CK, Network Security Appliances (T1590.006): https://attack.mitre.org/techniques/T1590/006