// MITRE ATT&CK
T1590 · Gather Victim Network Information
🎯 Reconnaissance PRE
Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries ma...
¿Cómo detectarlo y mitigarlo?
La detección de Gather Victim Network Information parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Sub-técnicas (6)
T1590.001
Domain Properties T1590.002
DNS T1590.003
Network Trust Dependencies T1590.004
Network Topology T1590.005
IP Addresses T1590.006
Network Security Appliances
Domain Properties T1590.002
DNS T1590.003
Network Trust Dependencies T1590.004
Network Topology T1590.005
IP Addresses T1590.006
Network Security Appliances
Técnicas relacionadas
T1592
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1596.002
WHOIS T1594
Search Victim-Owned Websites
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1596.002
WHOIS T1594
Search Victim-Owned Websites
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.