Search Threat Vendor Data (T1681) is a Reconnaissance technique. The adversary studies threat intelligence about their own campaigns, and about other actors in similar industries or with similar goals. MITRE lists PRE as the platform, meaning it happens before any target system is touched.
How attackers use it
Reports from closed and open sources can describe behavior, detail attacks, list atomic indicators such as malware hashes or IP addresses, and give timelines of a group's activity. Adversaries read them and may change how they operate in later work.
MITRE records two observations:
- Adversaries have replaced indicators named in blog posts in under a week.
- Adversaries have searched threat vendor data for their own domain names and then taken them down, likely to avoid seizure or further investigation.
MITRE points out that this differs from Threat Intel Vendors (T1597.001), where the adversary looks for information about a victim. Here, the adversary does reconnaissance on their own activity. One documented group registered accounts with threat intelligence vendor services to check for reporting on its infrastructure and to evaluate new infrastructure.
How to detect it
You mostly cannot. MITRE says this activity often has a very high occurrence and false positive rate, and may take place outside the target organization's visibility.
How to reduce the risk
MITRE gives one mitigation, Pre-compromise, with a candid note: this cannot be easily mitigated with preventive controls because the behavior happens outside enterprise defenses. The advice is to design defenses that do not rely on atomic indicators.
In practice:
- Treat hashes, IPs and domains as short-lived. They are useful for fast triage, not as your main control.
- Put effort into behavior-based detection: what a process does, not what it is named.
- Write detections around techniques and sequences that are costly for an adversary to change.
- Use intelligence to inform hunting hypotheses, not only blocklists.
Quick check
Why do indicator blocklists decay quickly?
Adversaries read published reports and can swap out the indicators mentioned, in some cases in under a week.
Sources
- MITRE ATT&CK, Search Threat Vendor Data (T1681): https://attack.mitre.org/techniques/T1681
