tfMITRE ATT&CK technique

Gather Victim Host Information T1592

Tactic: Reconnaissance
Platform: PRE
Version: 1.2
Created: 02 October 2020
Last modified: 24 October 2025
Contributor: Sam Seabrook, Duke Energy

Sub-techniques 410 rules across the family · 5 mapped directly to T1592 · 3 of 4 carry rules

.001Hardware1 .002Software1 .003Firmware0 .004Client Configurations4

Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1592

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 4

Data component	Name	Channel
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Response ContentDC0104

Internet Scan

—

Offense vs defense T1592

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 4

Data component	Name	Channel
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Response ContentDC0104

Internet Scan

—

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects enumeration of accounts configuration via api call to list different instances and services within a short period of time.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Reconnaissance Gather Victim Host Information	-	low	toffeebr33k	2020-11-21	2023-03-24	e9c14b23-47e2-4a8b-8a63-d36618e33d70	-
Splunk	The following analytic detects suspicious PowerShell script execution via EventCode 4104, specifically targeting checks for installed anti-virus products using WMI or PowerShell commands. (...)	Generic	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information	-	medium	Teoderick Contreras, Splunk	2021-06-14	2026-07-20	28077620-c9f6-11eb-8785-acde48001122
Splunk	The following analytic detects suspicious PowerShell activity via EventCode 4104, where WMI performs event queries to gather information on running processes or services. (...)	Anomaly	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Reconnaissance Gather Victim Host Information	-	medium	Teoderick Contreras, Splunk	2021-06-18	2026-05-13	018c1972-ca07-11eb-9473-acde48001122
Splunk	The following analytic identifies the execution of the dxdiag.exe process with specific command-line arguments, which is used to gather system information. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Reconnaissance Gather Victim Host Information	-	medium	Teoderick Contreras, Splunk	2021-11-19	2026-05-13	f92d74f2-4921-11ec-b685-acde48001122
Splunk	The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI performs an event query to list running processes or services. (...)	Anomaly	stable	ps_script	windows	PowerShell	Reconnaissance Gather Victim Host Information	-	medium	Teoderick Contreras, Splunk	2021-06-14	2026-05-13	b5cd5526-cce7-11eb-b3bd-acde48001122

Title

Description

Gather Victim Host Information T1592

Gather Victim Host Information T1592

Gather Victim Host Information MITRE reference T1592

Offense vs defense T1592

Gather Victim Host Information detection strategy DET0826

Detection of Gather Victim Host Information

Log sources

Gather Victim Host Information MITRE reference T1592

Offense vs defense T1592

Gather Victim Host Information detection strategy DET0826

Detection of Gather Victim Host Information

Log sources

Gather Victim Host Information detections T1592

Gather Victim Host Information detections T1592