Technique
technique:reconnaissance
Also: active reconnaissance, passive reconnaissance, recon, surveillance
The first phase of the cyber kill chain, involving information gathering and mapping of the target.
The first phase of the cyber kill chain, involving information gathering and mapping of the target.
“Phase one is reconnaissance.”
“passive reconnaissance and mapping”
Collection of information about users, hosts, services, shares, hardware, and network structure before further testing.
“That’s kind of the standard approach.”
“This is all part of the reconnaissance phase.”
Pre-engagement observation and information gathering used to identify physical security weaknesses.
“First, he does some reconnaissance.”
“I spend like, one-night recon”
Discovery of an organization's internet-facing assets, domains, subdomains, and services.
“the act of recon for a bank or any big web entity is basically finding all of their assets that are connected to the internet”
Observation and collection of information about facilities, personnel, patrols, entrances, and security systems before an assessment.
“That was almost a week of recon.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Nation State Actor | Explicit | 10 |
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | USES | FC | Explicit | 66 |
| incoming | USES | Jason Haddix | Explicit | 130 |
| incoming | USES | Deviant Ollam | Explicit | 134 |
Nation State Actor USES Reconnaissance
The operator performs passive reconnaissance and network mapping to identify exposed systems, software, and access vectors.
Explicit Confidence 98% · Nsa EP 10 Details
“now it’s things like passive reconnaissance and mapping”
Tinker Secor USES Reconnaissance
Tinker describes password, active, and environmental reconnaissance as part of his standard approach.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“Get in and do password reconnaissance, active reconnaissance”
FC USES Reconnaissance
FC conducts reconnaissance before physical penetration tests.
Explicit Confidence 98% · FC EP 66 Details
“I go to this hospital. I spend like, one-night recon”
Jason Haddix USES Reconnaissance
Jason performed reconnaissance to find the bank's publicly exposed web assets and servers.
Explicit Confidence 99% · Jason Haddix EP 130 Details
“We started doing recon on them. We had found a whole bunch of web servers”
Deviant Ollam USES Reconnaissance
Deviant describes observing buildings, guards, traffic, and entry points before conducting physical tests.
Explicit Confidence 99% · Deviant Ollam EP 134 Details
“That was almost a week of recon.”