Search Closed Sources (T1597) is a reconnaissance technique in MITRE ATT&CK. Its platform is PRE. Where its sibling, Search Open Technical Databases, uses free sources, this one uses sources that are paid, private or otherwise not freely available.
You do not control those sources, and you will not see the lookup. That makes it a technique to understand more than one to detect.
How attackers use it
MITRE says information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical or threat intelligence data. Adversaries may also buy from less reputable sources, such as the dark web or cybercrime black markets.
Which source they pick depends on what they want to learn. MITRE lists two sub-techniques:
- Threat Intel Vendors (T1597.001)
- Purchase Technical Data (T1597.002)
What comes back may lead to Phishing for Information or Search Open Websites/Domains, to developing or obtaining capabilities, and to initial access through External Remote Services or Valid Accounts.
The mention of Valid Accounts is worth noticing. Purchased data can include credentials, and a purchased password skips a lot of effort.
How to detect it
MITRE says much of this activity has a very high occurrence and a high false positive rate, and may take place outside your visibility, making detection difficult. The advice is to focus on related stages such as Initial Access.
That means paying attention to the places purchased data would be used: sign-in attempts against external remote services, logins that succeed from unfamiliar locations, and targeted messages to staff that use details that are not on your website.
How to reduce the risk
The MITRE mitigation is Pre-compromise. Because the behavior sits outside enterprise defenses, preventive controls cannot easily stop it. Focus on minimizing the amount and sensitivity of data available to external parties.
Practical steps:
- Require multi-factor authentication on external-facing services, so a bought password alone does not get in.
- Keep sensitive details out of places that get aggregated, such as public repositories and public documents.
- Rotate credentials when you learn they have been exposed.
- Reduce the number of exposed services, so purchased data has less to match against.
Check your own environment
- Do all external logins require more than a password?
- Do you have a process to reset credentials when exposure is reported?
- Do you know which external services accept authentication from the internet?
Quick check
Why is detection hard for this technique?
The adversary buys or reads data from sources outside your visibility, so there is nothing on your network to observe. Later stages like Initial Access are where to look.
