Purchase Technical Data (T1597.002) is a reconnaissance sub-technique of Search Closed Sources. Its platform is PRE, because the buying happens before any contact with you.
How attackers use it
MITRE says information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also buy from less reputable sources, such as dark web or cybercrime black markets.
They may buy information about targets they have already identified, or use purchased data to discover opportunities for a successful breach. According to MITRE, the technical details gathered can include employee contact information, credentials, or specifics about a victim's infrastructure.
The results can lead to Phishing for Information or Search Open Websites/Domains, to developing or obtaining capabilities, and to initial access through External Remote Services or Valid Accounts.
How to detect it
The purchase itself is invisible to you. MITRE says detection is difficult because of high occurrence, false positives and activity outside your visibility. Focus on Initial Access: failed and successful sign-ins to external services from unfamiliar sources, especially with real employee usernames.
How to reduce the risk
MITRE's mitigation is Pre-compromise, which means minimizing the amount and sensitivity of data available to external parties. Because purchased data can include credentials, add these:
- Turn on multi-factor authentication for every external remote service.
- Reset credentials when exposure is reported, and do not reuse passwords across services.
- Limit which employee details appear publicly.
- Keep the list of externally reachable services short.
Quick check
Which kinds of purchased data does MITRE say can help an adversary?
Employee contact information, credentials, and specifics about the victim's infrastructure.
