Gather Victim Network Information T1590

Tactic: Reconnaissance

Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

Events covered

13 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 18 rules share fields, values, and exclusions.

Fields filtered most (27 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventID4eq 422, 4104
QueryName4in 3, contains 1, eq 1*api.ip.sb, *api.ipify.org, *b.barracudacentral.org, *anthropic*, *api.openrouter*
sourcetype3eq 2, in 1cisco:asa, cisco:ios, cisco:nvm:flowdata, cisco:nvm:flowdata:v2
Image2ends_with 2, eq 1, starts_with 1\brave.exe, \crassus.exe, \maxthon.exe, \msedge.exe
command2contains 1, in 1show access-list*, show capture*, show conn*, suspiciouscommands
process_name2eq 2dnscmd.exe, wermgr.exe
unique_recon_commands2ge 24, 7
CommadCount1ge 18
CommandLine1contains 1 /enumrecords
DNSQueryCount1gt 110
Description1contains 1crassus
DistinctIps1gt 11
NetworkDirection1eq 1Inbound
OriginalFileName1eq 1crassus.exe
ScriptBlockText1in 1*get-clipboardtext*, *returnhotfixid*, *start-aclcheck*

Top indicator values (223 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventIDeq
22
317
EventIDeq
4104
1269
QueryNamein
*api.ip.sb
22
QueryNamein
*api.ipify.org
22
QueryNamein
*b.barracudacentral.org
22
QueryNamein
*cbl.abuseat.org
22
QueryNamein
*dnsbl-1.uceprotect.net
22
QueryNamein
*icanhazip.com
22
QueryNamein
*ip.anysrc.com
22
QueryNamein
*ipecho.net
22
QueryNamein
*ipinfo.io
22
QueryNamein
*spam.dnsbl.sorbs.net
22
QueryNamein
*wtfismyip.com
22
QueryNamein
*zen.spamhaus.org
22
QueryNamein
ident.me
22
QueryNamein
www.myexternalip.com
22
CommadCountge
8
1
CommandLinecontains
/enumrecords
1
DNSQueryCountgt
10
1
Descriptioncontains
crassus
1
DistinctIpsgt
1
1
Imageends_with
\brave.exe
111
Imageends_with
\crassus.exe
1
Imageends_with
\maxthon.exe
13
Imageends_with
\msedge.exe
114
Imageends_with
\msedgewebview2.exe
13
Imageends_with
\opera.exe
111
Imageends_with
\safari.exe
12
Imageends_with
\seamonkey.exe
13
Imageends_with
\vivaldi.exe
111

Exclusions (88 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
DNSQueryCountgt
10
1
Imageends_with
\\lm studio.exe
1
Imageends_with
\brave.exe
1
Imageends_with
\maxthon.exe
1
Imageends_with
\msedge.exe
1
Imageends_with
\msedgewebview2.exe
1
Imageends_with
\opera.exe
1
Imageends_with
\safari.exe
1
Imageends_with
\seamonkey.exe
1
Imageends_with
\vivaldi.exe
1
Imageends_with
\whale.exe
1
Imageends_with
\windowsapps\microsoftedge.exe
1
Imageeq
c:\program files (x86)\google\chrome\application\chrome.exe
1
Imageeq
c:\program files (x86)\internet explorer\iexplore.exe
1
Imageeq
c:\program files (x86)\microsoft\edge\application\msedge.exe
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 4 rules

Elastic 1 rule

Splunk 8 rules

Kusto 5 rules