T1597: Search Closed Sources — MITRE ATT&CK Technique

Description

Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.(Citation: ZDNET Selling Data)

Adversaries may search in different closed databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).

Platforms

PRE

Sub-Techniques (2)

T1597.001

Threat Intel Vendors

T1597.002

Purchase Technical Data

Mitigations (1)

Pre-compromiseM1056

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

Threat Groups (1)

ID	Group	Context
G1011	EXOTIC LILY	[EXOTIC LILY](https://attack.mitre.org/groups/G1011) has searched for information on targeted individuals on business databases including RocketReach ...

References

Cimpanu, C. (2020, May 9). A hacker group is selling more than 73 million user records on the dark web. Retrieved October 20, 2020.

Frequently Asked Questions

What is T1597 (Search Closed Sources)?

T1597 is a MITRE ATT&CK technique named 'Search Closed Sources'. It belongs to the Reconnaissance tactic(s). Adversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting. Information about victims ma...

How can T1597 be detected?

Detection of T1597 (Search Closed Sources) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1597?

There are 1 documented mitigations for T1597. Key mitigations include: Pre-compromise.

Which threat groups use T1597?

Known threat groups using T1597 include: EXOTIC LILY.