// MITRE ATT&CK
T1591 · Gather Victim Org Information
🎯 Reconnaissance PRE
Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key e...
How to detect & mitigate it
Detecting Gather Victim Org Information starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Sub-techniques (4)
T1591.001
Determine Physical Locations T1591.002
Business Relationships T1591.003
Identify Business Tempo T1591.004
Identify Roles
Determine Physical Locations T1591.002
Business Relationships T1591.003
Identify Business Tempo T1591.004
Identify Roles
Related techniques
T1592
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1596.002
WHOIS T1594
Search Victim-Owned Websites
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1596.002
WHOIS T1594
Search Victim-Owned Websites
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.