// MITRE ATT&CK
T1596.002 · WHOIS
Sub-technique of T1596 · Search Open Technical Databases.
Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about ...
How to detect & mitigate it
Detecting WHOIS starts with your SIEM/EDR telemetry. Write a detection rule with the Sigma generator, analyze suspicious logs in the log analyzer, and place the technique on your coverage with the ATT&CK matrix.
Related techniques
T1592
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1594
Search Victim-Owned Websites T1596.001
DNS/Passive DNS
Gather Victim Host Information T1596.003
Digital Certificates T1597.002
Purchase Technical Data T1590.005
IP Addresses T1590.002
DNS T1682
Query Public AI Services T1594
Search Victim-Owned Websites T1596.001
DNS/Passive DNS
Source: MITRE ATT&CK®. ATT&CK is a registered trademark of The MITRE Corporation. Content for educational purposes.