Reconnaissance (TA0043)

The Attacker's Critical First Step & How to Stop It

Reconnaissance is the systematic information gathering that every cyber attacker performs before launching an assault. Think of it as the attacker's homework, and skipping it is like planning a heist without ever seeing the building blueprints.

This foundational phase determines the success or failure of everything that follows. A skilled attacker who executes effective Reconnaissance understands your digital footprint, identifies your weakest points, and crafts a bespoke attack that bypasses generic defenses. For defenders, catching this phase is your golden opportunity to stop an attack before it truly begins, turning a potential breach into a mere failed attempt.

The Core Analogy: Cat Burglars & Digital Footprints

Vocabulary Decoder Ring

• Attack Surface: The sum total of all possible points (hardware, software, cloud services, employees) where an unauthorized user can try to enter or extract data. Why it matters here: Reconnaissance is the process of mapping and understanding your attack surface better than you do.
• Open Source Intelligence (OSINT): Information gathered from publicly available sources. This isn't hacking; it's using Google, social media, business registries, and certificate databases. Why it matters here: 80% of an attacker's recon uses free, legal OSINT tools to find critical vulnerabilities.
• Passive Reconnaissance vs. Active Reconnaissance: Passive recon involves gathering data without directly interacting with the target's systems (e.g., viewing cached pages). Active recon involves interacting with the target (e.g., scanning ports), which is louder and more detectable. Why it matters here: Defenders can only realistically hope to detect active reconnaissance; passive recon happens invisibly.
• Domain Name System (DNS) Enumeration: The process of locating all DNS servers and records for a target domain to map subdomains and related infrastructure. Why it matters here: It's a primary recon technique to discover forgotten, unpatched, or misconfigured subdomains (like test.example.com or legacy.example.com).

The Attacker's Playbook (Red Team View)

Red Team Analogy: The Burglar's Notebook

From the attacker's view, Reconnaissance is about building a target dossier. Our cat burglar's goal is confidence and precision. The feeling is one of calculated patience. The methodology is systematic: start broad (the neighborhood), then narrow in (the specific house, its routines, its weaknesses). Every bit of information reduces risk and increases the likelihood of a clean, untraceable entry.

Common Reconnaissance Techniques

• T1595 - Active Scanning: Proactively probing the target's external network (e.g., port scanning, vulnerability scanning) to discover live hosts and services.
• T1589 - Gather Victim Identity Information: Collecting employee names, email addresses, job titles, and social media profiles to enable phishing and social engineering.
• T1590 - Gather Victim Network Information: Mapping the target's network boundaries, IP ranges, domain names, DNS records, and network topology.
• T1596 - Search Open Technical Databases: Querying public repositories like Shodan, Censys, or SSL certificate databases to find exposed assets and technologies.
• T1592 - Gather Victim Host Information: Determining details about the target's operating systems, software versions, and hardware to tailor exploits.

The Reconnaissance Toolbox

• Maltego: A powerful OSINT and data-linkage tool that visually maps relationships between people, companies, domains, and infrastructure.
• Shodan / Censys: Search engines for internet-connected devices. They allow attackers to find specific servers, webcams, or industrial control systems with known vulnerabilities.
• theHarvester: A simple but effective tool for gathering emails, subdomains, hosts, and employee names from public sources like search engines and PGP key servers.

Command-Line Glimpse

The Defender's Handbook (Blue Team View)

Blue Team Analogy: The Neighborhood Watch

From the defender's chair, you are the Neighborhood Watch coordinator. You can't stop the burglar from driving through the neighborhood (passive recon). But you can look for the unfamiliar car circling the block multiple times, the person taking photos of houses, or someone checking door handles. Your goal is to identify the suspicious pattern before the break-in occurs.

SOC Reality Check: What Recon Looks Like in Logs

• Firewall Logs: A single external IP making sequential connection attempts to ports 22 (SSH), 443 (HTTPS), 3389 (RDP), and 445 (SMB) across your entire public IP range. This is a classic port scan.
• Web Server Logs (Apache/Nginx): An unusual spike in requests to non-existent URLs, common vulnerability paths (e.g., /wp-admin/, /phpmyadmin/), or requests with tools like "sqlmap" or "nikto" in the User-Agent string.
• DNS Query Logs: External IPs performing massive volumes of DNS queries for your subdomains (A, AAAA, MX, TXT records), especially using tools like dnsrecon or sublist3r patterns.

Threat Hunter’s Eye: A Hunt Hypothesis

Hypothesis: "An adversary is performing targeted subdomain enumeration against our primary domain prior to a phishing campaign."
Hunt: Query DNS logs for sources generating an abnormally high volume of unique subdomain permutations (e.g., api-dev, mail-test, vpn-staging) within a short time window, especially from IPs associated with cloud/VPS providers (DigitalOcean, AWS, Linode) not used by your legitimate employees.

Defensive Tools & Categories

• Threat Intelligence Platforms (TIPs): Services like Recorded Future or AlienVault OTX that can alert you if your company's assets appear in underground forums or scanning databases.
• Security Information and Event Management (SIEM): The central brain for correlating recon activity from firewalls, DNS, web proxies, and endpoint logs.
• Attack Surface Management (ASM) Tools: Platforms like Cortex Xpanse or Rapid7 that continuously discover and assess your external-facing digital assets from an attacker's perspective.

Blue Team Command: Sigma Rule Snippet

title: Potential DNS Reconnaissance / Zone Transfer Attempt
description: Detects multiple AXFR or IXFR type DNS queries which are indicative of a DNS zone transfer attempt, a common reconnaissance technique.
logsource:
    category: dns
detection:
    selection:
        query_type:
            - 'AXFR'
            - 'IXFR'
    condition: selection
falsepositives:
    - Legitimate network administration or DNS replication between trusted servers
level: medium
		

Real-World Example: From Headlines to Logs

Narrative: The 2020 SolarWinds SUNBURST compromise is a masterclass in sophisticated cyber operations. Before the infamous malicious update was deployed, the threat actors (believed to be APT29/Cozy Bear) conducted extensive, patient reconnaissance.

Explicit Connection: In the SolarWinds attack, the threat group used Reconnaissance when they systematically mapped SolarWinds' internal network, development environment, and update infrastructure after gaining an initial foothold. This allowed them to understand the build process, identify the perfect vehicle for their malware (the Orion platform's update mechanism), and craft an attack that remained undetected for months, ultimately compromising thousands of downstream customers.

Their recon was so thorough that they even identified and avoided certain high-security customer networks, demonstrating how recon informs not just the attack, but also the attacker's risk assessment.

Mapping the MITRE ATT&CK Reconnaissance Landscape

Below are the top-level Techniques for TA0043 - Reconnaissance. Remember, each of these contains numerous Sub-techniques that detail specific procedures. This table is your high-level map.

Key Takeaways & Immediate Actions

Further Learning & References

• MITRE ATT&CK® Tactics: Reconnaissance (TA0043) - The official, authoritative source. Bookmark this page for the most up-to-date techniques and sub-techniques.
• CISA Alert (AA21-291A): APT29 Targeting COVID-19 Vaccine Development - A real-world case study showing detailed reconnaissance tradecraft used by a sophisticated state actor.
• SANS Blog: OSINT as a Super-Power for Defenders - Learn how to turn the attacker's primary tool (OSINT) into a powerful defensive capability.
• Next Tactic: Initial Access (TA0001) - Once reconnaissance is complete, attackers need a way in. Learn about the next critical phase in the MITRE ATT&CK framework.