Threat Intel Vendors (T1597.001) is a reconnaissance sub-technique of Search Closed Sources. The platform is PRE.
Threat intelligence vendors often offer paid feeds or portals with more data than what is publicly reported. An adversary with access to one can read it too.
How attackers use it
MITRE says that although sensitive details such as customer names and other identifiers may be redacted, vendor data may contain trends about breaches, including target industries, attribution claims, and successful tactics, techniques and procedures and countermeasures.
There is a boundary worth knowing. If a threat actor searches for information on their own activities, MITRE files that under a different technique, Search Threat Vendor Data. This one is about learning about victims.
The information can lead to other reconnaissance such as Search Open Websites/Domains, to developing or obtaining capabilities, and to initial access through Exploit Public-Facing Application or External Remote Services.
How to detect it
You will not see it. MITRE says this activity has a high occurrence and false positive rate and may happen outside your visibility, so focus on related stages such as Initial Access.
How to reduce the risk
MITRE's mitigation is Pre-compromise: the technique is outside enterprise defenses, so minimize the amount and sensitivity of data available to external parties.
- Review what your own reports to vendors and information sharing groups reveal, and share only what is needed.
- Assume that your industry and the techniques that succeeded against peers are known to adversaries, and defend the common paths first.
- Harden internet-facing applications and remote access, the two initial access routes MITRE names here.
Quick check
What useful trends can vendor data show an adversary?
Target industries, attribution claims, and which techniques and countermeasures have worked, even with customer names redacted.
