tfMITRE ATT&CK technique

Gather Victim Network Information T1590

Tactic: Reconnaissance
Platform: PRE
Version: 1.0
Created: 02 October 2020
Last modified: 24 October 2025

Sub-techniques 612 rules across the family · 5 mapped directly to T1590 · 3 of 6 carry rules

.001Domain Properties2 .002DNS2 .003Network Trust Dependencies0 .004Network Topology0 .005IP Addresses4 .006Network Security Appliances0

Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1590

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 3

Offense vs defense T1590

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 3

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services. (...)	Hunting	stable	dns	windows	Sysmon	Reconnaissance Gather Victim Network Information	-	medium	Rod Soto, Nasreddine Bencherchali, Splunk	2025-11-24	2026-07-15	d7ceffc5-a45e-412b-b9fa-2ba27c284503
	Detect the update check performed by Advanced IP/Port Scanner utilities.	Generic	test	proxy	-	-	Reconnaissance Gather Victim Network Information	-	medium	Axel Olsson	2022-08-14	2024-02-15	1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d
	Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.	Generic	test	dns	windows	Sysmon	Reconnaissance Gather Victim Network Information	-	medium	Brandon George (blog post), Thomas Patzke	2021-07-08	2024-03-22	ec82e2a5-81ea-4211-a1f8-37a0286df2c2
Splunk	Detects the execution of the WinPEAS PowerShell script via default function names used within the script. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information Software Client Configurations Reconnaissance Gather Victim Network Information Discovery Group Policy Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	5cb208df-e1aa-478d-ab2f-8270ff9999b9

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	Detects DNS queries related to local LLM models on endpoints by monitoring Sysmon DNS query events (Event ID 22) for known LLM model domains and services. (...)	Hunting	stable	dns	windows	Sysmon	Reconnaissance Gather Victim Network Information	-	medium	Rod Soto, Nasreddine Bencherchali, Splunk	2025-11-24	2026-07-15	d7ceffc5-a45e-412b-b9fa-2ba27c284503
	Detect the update check performed by Advanced IP/Port Scanner utilities.	Generic	test	proxy	-	-	Reconnaissance Gather Victim Network Information	-	medium	Axel Olsson	2022-08-14	2024-02-15	1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d
	Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.	Generic	test	dns	windows	Sysmon	Reconnaissance Gather Victim Network Information	-	medium	Brandon George (blog post), Thomas Patzke	2021-07-08	2024-03-22	ec82e2a5-81ea-4211-a1f8-37a0286df2c2
Splunk	Detects the execution of the WinPEAS PowerShell script via default function names used within the script. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information Software Client Configurations Reconnaissance Gather Victim Network Information Discovery Group Policy Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	5cb208df-e1aa-478d-ab2f-8270ff9999b9

Gather Victim Network Information T1590

Gather Victim Network Information T1590

Gather Victim Network Information MITRE reference T1590

Offense vs defense T1590

Gather Victim Network Information detection strategy DET0869

Detection of Gather Victim Network Information

Gather Victim Network Information MITRE reference T1590

Offense vs defense T1590

Gather Victim Network Information detection strategy DET0869

Detection of Gather Victim Network Information

Gather Victim Network Information detections T1590

Gather Victim Network Information detections T1590