Search Open Technical Databases (T1596) sits in the reconnaissance tactic of MITRE ATT&CK, with PRE as its platform. It covers an adversary looking up information about you in freely available technical sources, with no contact with your systems at all.
That last part is the catch. You will not see this in your logs, because the adversary is not talking to you. They are talking to a database.
How attackers use it
MITRE describes online databases and repositories that hold registrations of domains and certificates, as well as public collections of network data and artifacts gathered from traffic or scans.
Which source an adversary picks depends on what they want. MITRE lists five sub-techniques:
- DNS and Passive DNS (T1596.001)
- WHOIS (T1596.002)
- Digital Certificates (T1596.003)
- CDNs (T1596.004)
- Scan Databases (T1596.005)
What they learn may lead to other reconnaissance, such as Phishing for Information or searching open websites and domains. It may also help establish resources, by acquiring or compromising infrastructure, and it can open the door to initial access through External Remote Services or Trusted Relationship.
How to detect it
MITRE's candid answer is that much of this activity has a very high occurrence and a high false positive rate, and may take place completely outside your visibility. That makes direct detection difficult.
Its advice is to focus detection on related stages of the adversary lifecycle, such as Initial Access. If you cannot see the lookup, watch for what it enables: attempts against exposed remote services, logins to external-facing systems from new places, and targeted messages that use details someone had to look up.
How to reduce the risk
The MITRE mitigation is Pre-compromise. The technique happens outside enterprise defenses, so it cannot be easily stopped with preventive controls. The effort should go into minimizing the amount and sensitivity of data available to external parties.
Plain steps:
- Look up your own organization in the same sources an adversary would, and write down what you find.
- Remove or correct anything that exposes more than needed, such as internal hostnames in public records.
- Treat anything that is public as known. Do not rely on a hostname being obscure.
- Harden the services that show up in those results, because they are the ones that will be tried.
Check your own environment
Run a lookup of your primary domain (any OS with dig installed):
dig +short NS your-domain.example
dig +short MX your-domain.example
Then spend ten minutes in the public databases. Ask whether the list of hostnames, certificates and open ports matches what you intended to publish.
Quick check
Why can you not detect this technique directly?
The adversary queries third-party databases, not your systems, so the activity usually happens outside your visibility. MITRE suggests focusing on later stages such as Initial Access.
