Gather Victim Host Information (T1592): Detection and Mitigation

Gathering victim host information means collecting details about an organization's hosts. MITRE lists it under Reconnaissance with platform PRE, and the page was last modified in September 2026. Details include administrative data such as name, assigned IP, and function, as well as configuration specifics such as operating system and language.

Four sub-techniques sit under it: hardware, software, firmware, and client configurations.

How attackers use it

MITRE describes direct collection through active scanning or phishing for information. It also describes compromising a site and adding malicious content designed to collect host information from visitors, and exposure through accessible data sets such as social media and the victim's websites.

Adversaries may also read the User-Agent HTTP header, which a client sends to identify its application, operating system, vendor, or version. That can be used to decide what to do next.

The information can lead to more reconnaissance, to developing or obtaining capabilities, and to initial access through supply chain compromise or external remote services. Knowing a host's details lets an attacker choose something that will work.

Host information is the link between reconnaissance and exploitation. Software lists tell which flaws to try; hardware and firmware lists tell which devices exist; client details tell how to shape a payload.

The User-Agent point is a small example of a general rule: every request tells the server something about the client, and a malicious server can use it.

How to detect it

MITRE notes that this activity may have a very high occurrence and false positive rate, and may take place outside your visibility, which makes detection difficult. Its advice is to focus on related stages of the adversary lifecycle, such as initial access.

MITRE adds that internet scanners may be used to look for patterns associated with malicious content designed to collect information from visitors.

If you run websites that others rely on, check them for unexpected scripts that collect browser or system details. If you manage endpoints, review web proxy logs for visits to unfamiliar sites that profile visitors.

Inventory and monitoring go together. A current list of hosts and software makes it easier to see a change, and web proxy logs make it possible to look back at who visited an unfamiliar site.

How to reduce the risk

• MITRE says this technique cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. Its guidance is to minimize the amount and sensitivity of data available to external parties.
• Limit version and product detail in banners, headers, and error pages on systems you control.
• Keep software and firmware current, so that what an attacker learns is less likely to be exploitable.
• Review public documents, job postings, and purchase records for detail about your systems.
• Control third party scripts on your own sites, and review them on a schedule.

A small step with a large effect is to keep the list of externally visible banners short and generic, and to review it after every platform change.

Check your own environment

A read-only look at what a web server tells visitors, using curl on Linux or macOS against a site you own:

curl -sI https://yourdomain.com | grep -i -E '^(server|x-powered-by):'

Questions to carry with you:

• Do our headers reveal product and version?
• Which job postings name our tools and platforms?
• Which third party scripts run on our public sites?

Quick check

Sources

• MITRE ATT&CK, Gather Victim Host Information (T1592): https://attack.mitre.org/techniques/T1592