How to Defeat MITRE ATT&CK Reconnaissance Techniques

Why Reconnaissance Matters in the Attack Lifecycle

Reconnaissance is the first phase of the MITRE ATT&CK framework for good reason. Before an adversary deploys malware, moves laterally, or exfiltrates data, they must first understand the target environment. The intelligence gathered during reconnaissance directly shapes the tools, exploits, and social-engineering lures an attacker will use in subsequent phases.

For defenders, this presents both a challenge and an opportunity. Reconnaissance activity is inherently noisier than later-stage tactics because the attacker is still probing the unknown. If security teams can detect and respond to reconnaissance early, they can disrupt an intrusion before any real damage occurs.

This post examines three critical reconnaissance techniques catalogued by MITRE ATT&CK: T1595 (Active Scanning), T1592 (Gather Victim Host Information), and T1589 (Gather Victim Identity Information). It outlines practical detection strategies for each.

T1595: Active Scanning

What It Is

Active scanning encompasses any technique where an adversary directly probes the target's infrastructure to discover live hosts, open ports, running services, and software versions. MITRE defines it as scanning "where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction" (MITRE ATT&CK T1595). Scanning is not only random Internet-wide sweeps: measurements from the firewalls of some 89,000 hosts across 1,300 networks found that around 30% of logged scan traffic came from localised scans targeting narrow address ranges and specific services, activity that darknet telescopes largely miss (Richter and Berger, ACM Internet Measurement Conference, 2019). The three sub-techniques are:

• T1595.001, Scanning IP Blocks: Systematically sweeping IP ranges with tools such as Nmap, Masscan, or ZMap to identify internet-facing assets.
• T1595.002, Vulnerability Scanning: Using automated scanners like Nessus, OpenVAS, or Nuclei to fingerprint services and test for known CVEs.
• T1595.003, Wordlist Scanning: Brute-forcing URI paths, subdomains, or API endpoints to discover hidden resources.

Detection Strategies

Active scanning generates distinctive network patterns that defenders can monitor. MITRE's own detection guidance for T1595 starts with monitoring "network data for uncommon data flows". The following controls turn that guidance into rules:

• Threshold-based alerting on connection volume: A single source IP establishing connections to an unusually high number of destination ports or hosts within a short window is a strong indicator. Configure your network detection and response (NDR) sensors to flag this behaviour.
• SYN-to-SYN/ACK ratio analysis: Port scans typically produce a high ratio of SYN packets to completed handshakes. Monitoring this ratio at the perimeter can surface scanning activity that simple firewall logs might miss.
• User-Agent and header anomaly detection: Vulnerability scanners often leave identifiable signatures in HTTP headers. Maintaining a list of known scanner User-Agent strings and alerting on matches is a low-effort, high-value detection.
• DNS query volume spikes: Subdomain enumeration tools generate bursts of DNS queries for non-existent records (NXDOMAIN responses). Monitoring authoritative DNS logs for sudden spikes in NXDOMAIN rates can reveal wordlist-based reconnaissance.

How SenseOn Detects Active Scanning

SenseOn's network micro-sensor captures full packet metadata at the endpoint level, meaning scanning activity is visible even when the attacker is inside the network perimeter. The cross-domain correlation engine correlates connection patterns across supervised models (known scanner signatures), unsupervised models (anomalous connection volumes), and deep-learning sequence models (temporal patterns in packet flows) to surface scanning with extremely low false-positive rates.

T1592: Gather Victim Host Information

What It Is

Before crafting an exploit, attackers need to know what software, hardware, and configurations their targets are running. T1592 covers the collection of host-level details, which MITRE describes as "administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.)". The four sub-techniques are:

• T1592.001, Hardware: Identifying device types, firmware versions, and architecture (e.g., ARM vs x86) through banner grabbing or exposed management interfaces.
• T1592.002, Software: Enumerating installed applications, operating system versions, and patch levels via exposed service banners, error pages, or publicly accessible configuration files.
• T1592.003, Firmware: Targeting IoT and OT devices to determine firmware versions with known vulnerabilities.
• T1592.004, Client Configurations: Harvesting browser versions, plugin inventories, and security-tool presence through JavaScript fingerprinting on attacker-controlled websites.

Detection Strategies

Because much of this information gathering occurs passively or on attacker-controlled infrastructure, detection requires a blend of internal and external monitoring:

• Monitor for information-disclosure vulnerabilities: Regularly audit your web applications and APIs for endpoints that leak version strings, stack traces, or server configuration details. Automated DAST tools can help, but manual review of error-handling paths is also important.
• Track JavaScript fingerprinting attempts: If you operate a web application, deploy Content Security Policy (CSP) headers that restrict script execution. On the defensive side, monitor outbound traffic for connections to known fingerprinting services.
• Baseline outbound data flows: Unusual outbound connections from servers that typically only handle inbound requests can indicate that an attacker has planted a reconnaissance payload. Behavioural baselines help surface these anomalies.
• Endpoint telemetry correlation: Tools that collect endpoint-level data, such as process trees, loaded modules, and file-system events, can detect when an attacker runs local enumeration commands like systeminfo, uname -a, or wmic after gaining initial access.

How SenseOn Detects Host Reconnaissance

SenseOn's lightweight endpoint agent continuously monitors process execution and command-line arguments. When a sequence of host-enumeration commands is executed, particularly by a process tree that does not match normal administrative activity, the platform raises a contextual alert that includes the full command chain, the parent process, and the user account involved.

T1589: Gather Victim Identity Information

What It Is

Identity reconnaissance targets the people within an organisation rather than the infrastructure. T1589 covers personal data such as employee names and email addresses, and sensitive details such as credentials or MFA configurations. Adversaries seek:

• T1589.001, Credentials: Searching paste sites, dark-web marketplaces, and breach databases for leaked usernames and passwords associated with the target domain.
• T1589.002, Email Addresses: Harvesting corporate email addresses from LinkedIn, company websites, GitHub commits, and WHOIS records to build phishing target lists.
• T1589.003, Employee Names: Compiling organisational charts and reporting structures to craft convincing business-email-compromise (BEC) lures.

Detection Strategies

• Dark-web and breach monitoring: Subscribe to threat intelligence feeds or services that monitor for your organisation's credentials appearing in breach dumps. Promptly force password resets for any affected accounts, and check new passwords against known-compromised lists as NIST requires (NIST SP 800-63B, section 5.1.1.2); breach alerting works in practice, with 26% of warnings in one large study leading users to move to a new password at least as strong as the original (Thomas et al., USENIX Security, 2019).
• Email-address enumeration detection: If your mail server responds differently to valid versus invalid recipients (e.g., different SMTP response codes), attackers can enumerate valid addresses. Configure your mail transfer agent to return uniform responses regardless of address validity.
• Phishing simulation and awareness: While not a technical detection, regular phishing simulations help gauge your organisation's susceptibility to lures built from identity reconnaissance and improve staff vigilance.
• Impossible-travel and credential-stuffing detection: Monitor authentication logs for sign-in attempts from geographically improbable locations or for high-velocity login attempts across many accounts, strong indicators that harvested credentials are being tested.

How SenseOn Detects Identity-Based Attacks

SenseOn ingests authentication telemetry from endpoints, cloud identity providers, and network authentication protocols. Its behavioural analytics engine builds per-user baselines covering login times, source locations, devices, and access patterns. When a credential-stuffing campaign or an impossible-travel event deviates from these baselines, the platform generates a high-confidence alert enriched with full session context.

Building a Unified Reconnaissance Defence

Detecting reconnaissance in isolation is helpful, but the real defensive advantage comes from correlating reconnaissance signals across all three categories. An attacker who scans your perimeter (T1595), fingerprints your web servers (T1592), and harvests employee email addresses (T1589) is likely in the early planning stages of a targeted intrusion.

The table below maps each technique to the telemetry that exposes it and the single highest-value rule to start with.

Security teams should:

• Centralise telemetry: Ensure network, endpoint, identity, and threat-intelligence data flows into a single analytics platform so that weak signals from different reconnaissance techniques can be correlated into a strong composite indicator.
• Automate enrichment: When a scanning alert fires, automatically enrich it with threat-intelligence lookups on the source IP, recent credential-breach data for your domain, and any related host-fingerprinting events.
• Implement deception: Deploy honeypots, honey tokens, and canary files that are invisible to legitimate users but irresistible to attackers performing reconnaissance. Because legitimate users have no reason to touch a decoy, any interaction is a high-confidence indicator of malicious intent, although the research literature cautions that the effectiveness of deception has not been measured as rigorously as vendors' "zero false positive" claims suggest (Han et al., ACM Computing Surveys, 2018).
• Adopt a continuous-validation mindset: Use breach-and-attack simulation (BAS) tools to periodically test whether your detection capabilities actually catch the reconnaissance techniques described above. Detection rules degrade over time as infrastructure changes; regular validation keeps them sharp.

By treating reconnaissance not as mere noise but as actionable intelligence, security teams can shift from reactive incident response to proactive threat disruption, stopping attacks before they begin.

Related reading:

• MITRE ATT&CK Initial Access Techniques
• MITRE ATT&CK Lateral Movement: Detection and Prevention
• Threat Hunting: A Practical Guide

Sources

• MITRE ATT&CK, Active Scanning, Technique T1595, accessed 20 September 2026
• MITRE ATT&CK, Gather Victim Host Information, Technique T1592, accessed 20 September 2026
• MITRE ATT&CK, Gather Victim Identity Information, Technique T1589, accessed 20 September 2026
• Philipp Richter, Arthur Berger, "Scanning the Scanners: Sensing the Internet from a Massively Distributed Network Telescope", ACM Internet Measurement Conference, 2019, https://doi.org/10.1145/3355369.3355595 (open access: https://doi.org/10.1145/3355369.3355595)
• NIST, "Digital Identity Guidelines: Authentication and Lifecycle Management", Special Publication 800-63B, sections 5.1.1.2 and 5.2.2, https://pages.nist.gov/800-63-3/sp800-63b.html
• Kurt Thomas, Jennifer Pullman, Kevin Yeo, Ananth Raghunathan, Patrick Gage Kelley, Luca Invernizzi, Borbala Benko, Tadek Pietraszek, Sarvar Patel, Dan Boneh, Elie Bursztein, "Protecting accounts from credential stuffing with password breach alerting", USENIX Security Symposium, 2019, https://www.usenix.org/conference/usenixsecurity19/presentation/thomas (open access)
• Xiao Han, Nizar Kheir, Davide Balzarotti, "Deception Techniques in Computer Security: A Survey", ACM Computing Surveys, 2018, https://doi.org/10.1145/3214305

How SenseOn writes, checks and corrects its content: editorial standards.