Contagious InterviewG1052 ↗
Has utilized open-source indicator of compromise repositories to determine their exposure to include VirusTotal, and MalTrail.1
tfMITRE ATT&CK technique
Search Open Websites/Domains T1593
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.1
- Created
- 02 October 2020
- Last modified
- 12 May 2026
Sub-techniques 32 rules across the family · 0 mapped directly to T1593 · 1 of 3 carry rules
Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.[1][2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Search Open Websites/Domains MITRE reference T1593
Top 25%of all ATT&CK techniques for number of groups
6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Star BlizzardG1033 ↗
Has used open-source research to identify information about victims to use in targeting.12
Volt TyphoonG1017 ↗
Has conducted pre-compromise web searches for victim information.1
Mustang PandaG0129 ↗
Has used open-source research to identify information about victims to use in targeting to include creating weaponized phishing lures and attachments.12
APT-C-36G0099 ↗
Has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.1
Sandworm TeamG0034 ↗
Researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.1
All 6 groups for this technique
Offense vs defense T1593
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Search Open Websites/Domains detection strategy DET0856
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Search Open Websites/Domains
1 platform
AN1988 · PRE
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
Application developers uploading to public code repositories should be careful to avoid publishing sensitive information such as credentials and API keys.
AuditM1047
Scan public code repositories for exposed credentials or other sensitive information before making commits. Ensure that any leaked credentials are removed from the commit history, not just the current latest version of the code.