WHOIS Reconnaissance and How to Limit It (T1596.002)

WHOIS (T1596.002) is a reconnaissance sub-technique under Search Open Technical Databases. The platform is PRE, so it happens before any access.

WHOIS data is kept by the regional Internet registries responsible for allocating Internet resources such as domain names. Anyone can query it.

How attackers use it

MITRE says anyone can query WHOIS servers for details about a registered domain, such as assigned IP blocks, contact information and DNS nameservers. Threat actors can use online resources or command-line utilities to comb through it for potential victims.

The results can lead to other reconnaissance, such as Active Scanning or Phishing for Information. They can also help establish resources by acquiring or compromising infrastructure, and open paths to initial access through External Remote Services or Trusted Relationship.

A contact name and email in a record is a ready-made target list for phishing for information. Assigned IP blocks hand over scan targets.

How to detect it

You will not see a WHOIS lookup in your logs. MITRE says much of this activity has a very high occurrence and false positive rate, and may occur outside your visibility, so detection is difficult. Concentrate on later stages such as Initial Access.

How to reduce the risk

MITRE's mitigation is Pre-compromise. This cannot easily be stopped with preventive controls, so minimize the amount and sensitivity of data available to external parties.

• Use role-based contact addresses in registration records, not named individuals.
• Where your registrar offers it, use privacy or redaction options for contact data.
• Keep registrant details accurate so you can still recover a domain.
• Remember that assigned IP blocks and nameservers are not hideable, so protect the services behind them.

Quick check

Sources

• MITRE ATT&CK, WHOIS (T1596.002)