Scan Databases (T1596.005) is a reconnaissance sub-technique of Search Open Technical Databases. The platform is PRE, because the search happens before any access.
Various online services continuously publish the results of internet scans and surveys. An adversary does not need to scan you. Someone else already did and wrote it down.
How attackers use it
MITRE says these services often harvest active IP addresses, hostnames, open ports, certificates and even server banners. Threat actors use online resources and lookup tools to pull information from them.
Two uses are described. Adversaries may look for information about targets they have already identified, or use these datasets to discover opportunities for successful breaches.
The results can lead to more reconnaissance such as Active Scanning or Search Open Websites/Domains, to establishing resources by developing or obtaining capabilities, and to initial access through External Remote Services or Exploit Public-Facing Application.
This is why exposure is not only about what you scan yourself. If a remote service has been open for a week, there is a good chance a survey has already recorded it.
How to detect it
You cannot see this. MITRE says the activity has a very high occurrence and false positive rate and may take place entirely outside your visibility, so detection is difficult. Focus detection on related stages such as Initial Access, for example attempts against remote services that appear in these datasets.
How to reduce the risk
MITRE's mitigation is Pre-compromise. The activity is outside your defenses, so the aim is to minimize the amount and sensitivity of data available to external parties.
- Keep a live inventory of internet-facing assets and open ports.
- Search the public scan databases for your own addresses and domains on a schedule, and compare the results with the inventory.
- Close and remove anything unintended, then re-check.
- Patch and harden what must stay open, since it is the part attackers will choose from.
- Watch for new exposure after changes, because databases update continuously.
Check your own environment
Confirm what a host exposes from the inside (Linux, iproute2):
ss -tulpn
Then look up your own public addresses in a scan database and compare. Differences are the finding.
Try it yourself
Asset discovery is the practice of finding your exposure before a survey does.
Click through it at your own pace, or open it full screen.
Quick check
Why can scan databases help an adversary even if nobody scanned you directly?
Public services already published IP addresses, hostnames, ports, certificates and banners for you, so the adversary can read them without sending traffic to you.
What is the best use of detection effort for this technique?
Related later stages, such as Initial Access against remote services that show up in those datasets.
