TA578G1038 ↗
Has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.1
tfMITRE ATT&CK technique
Search Victim-Owned Websites T1594
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.1
- Created
- 02 October 2020
- Last modified
- 24 October 2025
- Contributor
- James P Callahan, Professional Paranoid
Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses). These sites may also have details highlighting business operations and relationships.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
6
Threat groupsTop 25%
Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Search Victim-Owned Websites MITRE reference T1594
Top 25%of all ATT&CK techniques for number of groups
6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Volt TyphoonG1017 ↗
Has conducted pre-compromise reconnaissance on victim-owned sites.1
EXOTIC LILYG1011 ↗
Has used contact forms on victim websites to generate phishing e-mails.1
Silent LibrarianG0122 ↗
Has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.123
KimsukyG0094 ↗
Has searched for information on the target company's website.1
Sandworm TeamG0034 ↗
Has conducted research against potential victim websites as part of its operational planning.1
All 6 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors peformed reconnaissance of victims' internal websites via proxied connections.1
APT41 DUSTC0040 ↗
Involved access of external victim websites for target development.1
Leviathan Australian IntrusionsC0049 ↗
Leviathan enumerated compromised web application resources to identify additional endpoints and resources linkd to the website for follow-on access during Leviathan Australian Intrusions.1
All 3 campaigns for this technique
Offense vs defense T1594
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Search Victim-Owned Websites detection strategy DET0810
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Search Victim-Owned Websites
1 platform
AN1942 · PRE
Monitor for suspicious network traffic that could be indicative of adversary reconnaissance, such as rapid successions of requests indicative of web crawling and/or large quantities of requests originating from a single source (especially if the source is known to be associated with an adversary). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | Application Log | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.