{"id":"T1592","name":"Gather Victim Host Information","url":"https://attack.mitre.org/techniques/T1592","tactics":["reconnaissance"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0826","stix_id":"x-mitre-detection-strategy--b172a0fa-e429-4e6e-89b4-54dcfcefa893","name":"Detection of Gather Victim Host Information","url":"https://attack.mitre.org/detectionstrategies/DET0826","analytics":[{"id":"AN1958","stix_id":"x-mitre-analytic--ae4f420e-1d38-4f6e-b4b6-4b0932f596e7","name":"Analytic 1958","description":"Internet scanners may be used to look for patterns associated with malicious content designed to collect host information from visitors.(Citation: ThreatConnect Infrastructure Dec 2020)(Citation: ATT ScanBox)\nMuch of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0826#AN1958","platforms":["PRE"],"log_source_references":[{"name":"Internet Scan","channel":"None","data_component":"DC0104","data_component_name":"Response Content","log_source_slug":"internet-scan"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0826"],"techniques":["T1592"]}],"live":true,"version":"1.0","techniques":["T1592"]}],"sigma_rules":[],"kev_cves":[{"cveID":"CVE-2017-12637","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2013-0631","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}