Techniques › T1583.004 › AN2003
AN2003 Analytic 2003
PRE · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control. Once adversaries have provisioned a server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.</p>
- Detects
- T1583.004 Server
- Part of
- DET0871 Detection of Server
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| Internet Scan | None | DC0106 Response Metadata |
| Internet Scan | None | DC0104 Response Content |