Gather Victim Network Information (T1590): Detection and Mitigation

Gathering victim network information means collecting administrative and structural details about an organization's networks. MITRE lists it under Reconnaissance with platform PRE. Details include IP ranges and domain names, as well as topology and operations.

Six sub-techniques sit under it: domain properties, DNS, network trust dependencies, network topology, IP addresses, and network security appliances.

How attackers use it

MITRE describes direct collection through active scanning or phishing for information, and indirect collection from online and other accessible data sets, such as open technical databases.

What the adversary learns can lead to more reconnaissance, such as scanning or searching open websites. It can also support establishing operational resources by acquiring or compromising infrastructure, and it can point toward initial access through a trusted relationship.

In plain terms, the attacker builds a map: what you own, how it connects, and who else has a path in.

Each sub-technique answers a different question. Domain properties: what do you own? DNS: how are your names mapped? IP addresses: where do you live on the internet? Topology: how is it connected? Security appliances: what stands in the way? Trust dependencies: who else has a way in?

Seen together, they form a profile that lets an attacker pick a path: a vulnerable edge device, a forgotten subdomain, or a provider with more access than needed.

How to detect it

MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.

Where you have network telemetry, the signals sit in the active scanning side: sequential probes across your address space, repeated connection attempts to many ports, and requests that touch many hosts quickly from a single source. Those are covered under their own technique, so link your detection back to it.

The passive side, such as lookups in public databases, leaves no trace on your network at all.

Perimeter firewalls, DNS logs, and web logs are your best sources. Keep them long enough to look back, since reconnaissance often comes weeks before an attack.

When an incident does occur, search the older logs for the same source addresses. Early probing can help you understand how the attacker prepared.

How to reduce the risk

• MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
• List what a stranger can see: public IP ranges, host names, DNS records, and exposed management interfaces. Remove what is not needed.
• Keep an up to date asset inventory so you notice a host that should not be reachable.
• Restrict zone transfers and similar information services to named servers.
• Document third parties with network access and review them, since trust relationships are also a target.
• Segment networks so that knowing the layout from outside does not give easy movement.

Pick one sub-technique each month and review it. DNS in one, IP addresses in the next, and so on. Small reviews are more likely to happen than a single large one.

Check your own environment

• Do we have a list of every public IP address and what runs on it?
• Which management interfaces are reachable from the internet?
• Who are the third parties with connected network access, and is it still needed?
• When did we last compare our external view with our inventory?

Quick check

Sources

• MITRE ATT&CK, Gather Victim Network Information (T1590): https://attack.mitre.org/techniques/T1590