Adversaries may gather information about the client configurations of a victim. MITRE lists this under Reconnaissance with platform PRE, last modified in September 2026. Configuration details include operating system and version, virtualization, architecture such as 32 or 64 bit, language, and time zone.
How attackers use it
MITRE says collection can be direct, through active scanning such as listening ports, server banners, and user agent strings, or through phishing for information. Adversaries may also compromise sites and add content that collects host information from visitors.
Information may be exposed in job postings, network maps, assessment reports, resumes, or purchase invoices. The results can lead to more reconnaissance, to developing or obtaining capabilities, and to initial access through supply chain compromise or external remote services.
The common thread is tailoring. A payload that knows the language and architecture of its target has a better chance of working.
Time zone and language might seem like trivia. For an attacker choosing which lure to send, or whether a payload should run, they are useful filters. Architecture decides whether a compiled payload will work at all.
MITRE's page also lists the pattern of compromising a site to collect host information from visitors. If one of your own sites were compromised this way, your visitors would be the ones profiled, which is another reason to review the scripts that run on your pages.
How to detect it
MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.
MITRE adds that internet scanners may be used to look for patterns associated with malicious content designed to collect information from visitors.
For your own web properties, audit scripts that read client details and send them to third parties. For staff browsing, proxy logs can show visits to pages that profile visitors, though there is no certain way to tell good from bad.
Where you control a managed browser, you can see which extensions and scripts it runs. That helps with both the visitor side and the staff side of this technique.
How to reduce the risk
- MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
- Review third party scripts on your public pages and remove those you do not need.
- Standardize client builds, so a profile reveals less.
- Keep browsers and operating systems patched, so a tailored attack has less to work with.
- Review job postings for detail on client platforms.
Keep a baseline configuration for clients, and review exceptions. A smaller number of configurations means a profile reveals less and is easier to protect.
Check your own environment
- Which third party scripts run on our public pages, and who approved each?
- Do job postings name our client operating systems and versions?
- Are managed browsers and operating systems on a supported version?
- Do proxy logs let us look back at visits to unfamiliar sites?
Quick check
What does client configuration include?
Operating system and version, virtualization, architecture, language, and time zone.
What is one way adversaries may collect it from visitors?
By compromising a site and adding content designed to collect host information.
Sources
- MITRE ATT&CK, Client Configurations (T1592.004): https://attack.mitre.org/techniques/T1592/004
