Course › Lesson 1 of 7

Reconnaissance

Before most attacks there's a period of research. The attacker learns who works where, which technology the target uses, and where the weak points might be. This lesson covers what reconnaissance looks like, how MITRE ATT&CK describes it, why it's so hard to defend against, and how to show it in an attack graph.

1. What reconnaissance is

Reconnaissance is the attacker gathering information to plan the attack. It is the first stage of the Cyber Kill Chain, and in MITRE ATT&CK it's the Reconnaissance tactic.

Its purpose is to answer questions such as:

• Who works there, what their roles are, and how to reach them (names, email addresses, who approves payments).
• What technology the organisation uses: remote-access products, email services, software versions.
• Where the organisation is exposed: internet-facing systems, suppliers, physical sites.

Good reconnaissance makes every later stage easier. A phishing email sent to the right person, about the right topic, using the right name, is far more convincing than one sent at random.

2. Passive and active reconnaissance

Reconnaissance comes in two kinds, and the difference matters to defenders:

• Passive reconnaissance uses information that's already available: the organisation's website, social media, job adverts, search engines, public databases. The attacker never touches the target's systems, so the target can't see it happening.
• Active reconnaissance interacts with the target: scanning its internet-facing systems, or contacting its staff to draw out information. It can be detected, but it also tells the attacker things passive research can't, such as whether a system is really vulnerable.

Attackers usually start passively and move to active reconnaissance only when they know what they're looking for.

3. Reconnaissance in ATT&CK

ATT&CK's Reconnaissance tactic contains around a dozen techniques, most with more specific sub-techniques. The ones you'll use most:

In the builder, hover over any code to see ATT&CK's description. Notice that the first six are passive, and the last two are active.

4. Defending against reconnaissance

For almost every reconnaissance technique, ATT&CK lists just one mitigation: M1056 Pre-compromise. That's ATT&CK's way of saying this activity happens outside the organisation's systems, where defenders have little control. Reconnaissance is cheap for the attacker and very hard to prevent.

Defenders aren't powerless, though. In practice they can:

• reduce what's published: staff lists, email formats, technology named in job adverts, metadata in documents;
• watch for active reconnaissance: scanning of internet-facing systems can be detected and investigated;
• train staff to recognise attempts to extract information by phone or email (for T1598, ATT&CK does list M1017 User Training).

5. Reconnaissance in an attack graph

In an attack graph, reconnaissance usually appears in the first band or two:

• Preconditions are the exposures that made it possible: Staff list their jobs on LinkedIn, VPN gateway is reachable from the internet.
• Events are the research steps, each with a Reconnaissance technique.
• Results are the knowledge gained: Finance manager identified. In a full attack graph, these become the preconditions of later stages such as delivery.

Scoring reconnaissance takes some thought. Severity is usually low, since nothing has been damaged yet. Mitigability is usually low too, because the information is public. That combination is the point: reconnaissance is where the attacker gains the most for the least risk.

6. Worked example

An attacker plans an invoice scam against Riverside Clinic and needs to know who handles payments. They read the clinic's Meet the team page, then look those staff up on LinkedIn to find the finance manager.

Look at how it's built: the website step is T1594 (Search Victim-Owned Websites), yielding employee names (T1589.003). The LinkedIn step is T1593.001 (Social Media), yielding roles (T1591.004). Both mitigations are M1056, and the scores are low for severity and low for mitigability.

7. Your tasks

Each task opens in the builder with the scenario beside your graph. Build your graph, press Check my graph for feedback as often as you like, and then compare with the model answer. Your work on each task is saved in your browser separately from your other graphs.

When you've finished, you can send your graph and its activity log to your tutor with Email to tutor in the builder.

← Back to the course