Adversaries may gather information about a victim's business tempo. MITRE lists this under Reconnaissance with platform PRE. Business tempo covers operational hours and days of the week, and may also reveal when hardware and software are purchased and shipped.
How attackers use it
MITRE says the information may be gathered through direct elicitation, such as phishing for information, or from data sets such as social media and the victim's own websites.
It can support further reconnaissance, the creation or compromise of accounts, and initial access through supply chain compromise or a trusted relationship. Knowing when staff are away or busy helps choose a moment when response will be slow.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
The relevant defense is coverage. Confirm that alerts reach someone outside business hours, and that a weekend or holiday does not mean nobody is watching.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Avoid posting detailed schedules, out of office dates, and delivery timings in public.
- Make sure on call rotation covers nights, weekends, and holidays for the systems that matter.
- Review urgent requests that arrive at unusual times with extra care.
Quick check
What does business tempo include?
Operational hours and days of the week, and possibly the timing of hardware and software purchases and shipments.
What defense fits best?
Round the clock alert coverage, since the information is hard to withhold.
Sources
- MITRE ATT&CK, Identify Business Tempo (T1591.003): https://attack.mitre.org/techniques/T1591/003
