Reconnaissance.

What is reconnaissance?

Reconnaissance is a tactic in the MITRE ATT&CK framework, a public catalog of attacker behavior. MITRE describes it as adversaries actively or passively gathering information that can be used to support targeting. The word is often shortened to recon. Defenders use the same word for the same stage, so a report that mentions recon is talking about the research an attacker does before an intrusion.

How does reconnaissance work?

MITRE lists many techniques under this tactic. They include Active Scanning, Gather Victim Host Information, Gather Victim Identity Information, Gather Victim Network Information, Gather Victim Org Information, Phishing for Information, Search Closed Sources, Search Open Websites/Domains, Search Open Technical Databases and Search Victim-Owned Websites. MITRE says this intelligence supports later phases, including initial access planning. The names show two broad styles. Some techniques read information that is already public. Others send traffic or messages to the target to learn from the response.

MITRE describes Active Scanning as adversaries executing active reconnaissance scans to gather information that can be used during targeting. Its sub-techniques are Scanning IP Blocks, Vulnerability Scanning and Wordlist Scanning. A simple illustration: an attacker could check which of a company’s internet-facing systems answer a probe, then use that list when choosing what to target.

Why does it matter?

Reconnaissance happens before the part of an attack that most security tools are built to stop. MITRE says Active Scanning cannot be easily mitigated with preventive controls, because it is based on behaviors performed outside the scope of enterprise defenses and controls. This suggests that organizations cannot always stop recon, but they can learn what an outsider could find about them. Information that is public, such as details on a company website, can often be read without the company noticing.

How can you detect or reduce it?

MITRE’s detection advice for Active Scanning is to monitor for atypical network behaviors, such as processes with unusual communication patterns, traffic that deviates from established protocols, and gratuitous traffic inconsistent with normal operations. MITRE adds that organizations should focus on limiting external exposure of sensitive data. Because much recon uses public sources, a useful step is to review what your own organization exposes, so you know what an attacker could learn. Keeping watch on your outward-facing systems and public information is a way to see what others see.

• Monitor for atypical network behavior and unusual traffic.
• Limit what sensitive data is exposed externally.
• Review the information your organization makes public.

Is reconnaissance the same as scanning?

No. Scanning is one kind of reconnaissance. MITRE lists Active Scanning as one technique among many, and others such as Phishing for Information do not involve scanning at all. Recon is the wider goal of learning about a target.

Is reconnaissance the same as a vulnerability scan?

Not exactly. A vulnerability scan checks systems for known weaknesses. MITRE lists Vulnerability Scanning as a sub-technique of Active Scanning, so an attacker can use it as part of recon. The same method is also used for legitimate checks, so the purpose and permission decide whether it is an attack.

Sources

• MITRE ATT&CK: Reconnaissance tactic: adversary trying to gather information to plan future operations; lists techniques.
• MITRE ATT&CK: Active Scanning description, sub-techniques, mitigation and detection text.