Contagious InterviewG1052 ↗
Has registered accounts with Threat Intelligence vendor services to check for reporting associated with their infrastructure and to evaluate new potential infrastructure.1
tfMITRE ATT&CK technique
Search Threat Vendor Data T1681
- Tactic
- Reconnaissance
- Platform
- PRE
- Version
- 1.0
- Created
- 26 September 2025
- Last modified
- 24 October 2025
Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Search Threat Vendor Data MITRE reference T1681
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
UNC3886G1048 ↗
Has replaced indicators mentioned in open-source threat intelligence publications at times under a week after their release.1
All 2 groups for this technique
Offense vs defense T1681
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Search Threat Vendor Data detection strategy DET0866
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Search Threat Vendor Data
1 platform
AN1998 · PRE
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on designing defenses that are not reliant on atomic indicators.