Your DNS records, certificate logs, IP allocations and identity provider endpoints describe your network to anyone who asks, and adversaries ask before they attack. MITRE ATT&CK T1590 Gather Victim Network Information covers adversaries collecting administrative and technical details of a victim's networks, such as domains, IP ranges, topology, trust relationships and security appliances. In ATT&CK v20 it sits in Reconnaissance (TA0043) on the PRE platform with six sub-techniques. Most of this collection uses public sources you cannot see being queried, so ATT&CK's main mitigation is M1056 Pre-compromise, which focuses on minimising the amount and sensitivity of data available to external parties. This guide is for network, DNS, identity and threat intelligence teams and covers what leaks, how to review it the way an adversary would, and what to monitor. For the wider reconnaissance programme see the OSINT and Reconnaissance Guide; this page stays on network information.
Key takeaways
- Treat it as exposure reduction. You will rarely detect the lookup itself; you can control what the lookup returns and watch for the follow-on scanning and exploitation.
- DNS reveals your SaaS estate. ATT&CK notes that MX, TXT and SPF records can show use of providers such as Office 365, G Suite and Salesforce, which tells an adversary which identity platform to phish.
- Tenant metadata is public by design. Microsoft Entra publishes an OpenID Connect discovery document at a public endpoint for every tenant, and ATT&CK records AADInternals (S0677) gathering tenant domain information through public Microsoft APIs.
- Edge devices are the payoff. CISA reports Volt Typhoon conducted extensive pre-compromise reconnaissance of network topology and security measures, then exploited public-facing network appliances.
- Review yourself regularly. A quarterly self-assessment of DNS, certificates, IP space and tenant endpoints is the most useful control you own for T1590.
What T1590 covers
ATT&CK lists collection through active scanning, phishing for information and open sources such as WHOIS, DNS and passive DNS, and notes that the results can feed further reconnaissance, resource development such as acquiring infrastructure, and initial access through trusted relationships or external remote services. The six sub-techniques:
| Sub-technique | What is gathered | Where it leaks | ATT&CK v20 examples |
|---|---|---|---|
| T1590.001 Domain Properties | Owned domains, registrar, contacts, name servers; tenant domains | WHOIS and RDAP, registrar records, identity provider discovery endpoints | Sandworm Team reconnaissance of the Parliament of Georgia's domain; AADInternals gathering tenant domains |
| T1590.002 DNS | Name servers, subdomains, mail servers, records revealing third-party services | Public zones, zone transfers, passive DNS, certificate transparency | M1054 Software Configuration: restrict zone transfers to validated servers |
| T1590.003 Network Trust Dependencies | MSPs, contractors and partners with network access | Case studies, job ads, supplier pages, DNS records pointing at partners | M1056 only |
| T1590.004 Network Topology | External and internal layout, gateways, routers | Device configurations, documentation, scan data | Volt Typhoon topology reconnaissance; Salt Typhoon using configuration files from exploited devices; C0062 mapping topology with Claude Code |
| T1590.005 IP Addresses | Allocated blocks and addresses in use | Regional internet registry and ASN records, BGP data, scan data | HAFNIUM obtaining IP addresses of public Exchange servers; Andariel limiting watering holes to specific IP ranges |
| T1590.006 Network Security Appliances | Firewalls, proxies, VPNs, NIDS | Banners, certificates, login pages, forum posts | Volt Typhoon identifying security measures; 2025 Poland Wiper Attacks (C0063) using public forum details on a Fortinet perimeter device |
Host details such as software and hardware are a separate technique, T1592 Gather Victim Host Information, and scanning your ranges is T1595 Active Scanning.
Case: reconnaissance before edge exploitation
The joint advisory AA24-038A from CISA and partners states that Volt Typhoon conducts extensive pre-compromise reconnaissance to learn about a target's network architecture and operational protocols, including network topologies, security measures, typical user behaviour and key network and IT staff, and, per industry reporting, uses FOFA, Shodan and Censys to search for exposed infrastructure. Initial access typically came through known or zero-day vulnerabilities in public-facing routers, VPNs and firewalls. The advisory's relevant mitigations are to limit internet exposure of systems and management interfaces when not necessary and to keep an inventory of all IT assets. See the Volt Typhoon Threat Actor Profile and the Edge Device Exploitation by Threat Actors Guide.
What your network reveals and how to reduce it
These are NHI Mgmt Group recommendations built on M1056 and M1054. Review each source the way an outsider sees it:
| Source | What an outsider learns | Exposure reduction |
|---|---|---|
| Public DNS zones | Hostnames such as vpn, citrix, fw-mgmt, dev; mail and SaaS providers from MX and TXT | Use neutral hostnames for management services; remove stale records and verification TXT records no longer needed; keep internal names in internal zones (see the Split-Horizon DNS Guide) |
| Zone transfers (AXFR) | The full zone in one query | Allow transfers only to listed secondaries (M1054); test from outside |
| Dangling records | Records pointing at released cloud resources | Remove records when resources are deleted. See the Subdomain Takeover and Dangling DNS Guide |
| Certificate transparency | Every hostname on a publicly trusted certificate, including staging and internal-sounding names | Use wildcard or private CA certificates for internal hosts where appropriate; monitor CT for your domains. See the Certificate Transparency Guide |
| WHOIS, RDAP and registrar | Registrant contacts, name servers, related domains | Use role addresses and registrar privacy where policy allows; lock and protect registrar accounts (see the Authoritative DNS and Registrar Account Security Guide) |
| IP and ASN records, BGP | Your address blocks, upstream providers, routing | Keep registry contacts as roles; know which ranges you announce. See the BGP and Routing Security Guide |
| Identity provider discovery | Tenant existence, tenant ID, federated or managed domains, endpoints | Cannot be switched off; accept it, keep verified domains tidy, and harden what the endpoints lead to (phishing-resistant MFA, conditional access) |
| Edge device banners and login pages | Firewall, VPN and appliance vendor and sometimes version | Do not expose management interfaces to the internet; suppress version banners where supported |
| Public documents and job ads | Network diagrams, product lists, MSP names | Review architecture content before publication; describe skills, not exact versions, in job ads |
Identity provider tenant discovery
Microsoft documents that an OpenID Connect metadata document is served at a publicly accessible endpoint of the form login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration, where {tenant} can be a domain name, and that it lists the tenant's authorisation, token and key endpoints. Discovery documents are a standard OpenID Connect feature, so similar metadata exists for other identity providers. This tells an adversary that a domain uses a given cloud identity platform and gives it the tenant identifier. The defensive answer is not concealment but making the tenant hard to use: remove unused verified domains, block legacy authentication, enforce phishing-resistant MFA and restrict external collaboration. See the MITRE ATT&CK T1589 Gather Victim Identity Information guide for the identity side of reconnaissance.
Detection and monitoring
ATT&CK v20 detection strategies for T1590 (DET0869) and its sub-techniques (DET0847, DET0843, DET0828, DET0819, DET0815, DET0889) all note that this activity has a high occurrence and false positive rate and often happens outside your visibility, and direct effort to related stages such as initial access. Signals that are still worth collecting:
| Signal | Log source | Use |
|---|---|---|
| Zone transfer attempts from unlisted hosts | Authoritative DNS server logs | Should be zero successes; attempts identify reconnaissance sources |
| Bursts of queries for non-existent names | Authoritative DNS query logs (NXDOMAIN rates) | Subdomain brute forcing against your zones; feed source IPs to watch lists |
| Unexpected certificates for your domains | CT monitoring | Issuance you did not request, including for lookalike names |
| Probing of edge devices | Firewall, VPN and WAF logs | Requests to management and login paths from scanning sources, followed by exploit attempts |
| Tenant sign-in attempts | Entra ID or other identity provider sign-in logs | Password spraying and failed sign-ins for valid and invalid users after discovery |
| Changes in your exposure | External attack surface management | New hosts, ports, certificates and services appearing on your ranges |
For DNS telemetry design see the DNS Logging and Detection Guide.
Measuring it
- Exposed management interfaces: count of internet-reachable admin interfaces for firewalls, VPNs and hypervisors, trending to zero.
- Stale DNS records: records pointing to resources you no longer own, found and removed per quarter.
- Unknown internet assets: share of externally discovered hosts not in the asset inventory.
- Zone transfer exposure: authoritative servers that allow AXFR to arbitrary hosts (target: none).
- Edge patch time: median days to patch exploited vulnerabilities on internet-facing appliances.
How to run a self-assessment
- Scope: list every registered domain, IP block, ASN and identity tenant the organisation owns, with owners. Assess only assets you own or are authorised to test.
- Collect: pull public DNS, passive DNS history, CT entries, registry records and external scan results for those assets. See the Passive DNS and DNS History Guide.
- Compare: reconcile what the outside world sees against the asset inventory and flag unknown hosts, stale records and exposed management services.
- Reduce: remove or rename what is not needed, move management interfaces behind VPN or zero trust access, and restrict zone transfers.
- Verify: test zone transfers and management interface reachability from an external network after each change; roll back a DNS change by restoring the previous record from version control if a service breaks.
- Repeat: run quarterly and after major changes such as mergers or cloud migrations, and feed results to the attack surface management programme. See the Attack Surface Management Guide.
Where identity fits
Network information points adversaries at identity systems. SPF and MX records reveal the cloud email and identity platform, discovery endpoints confirm the tenant, and trust dependency research identifies MSPs whose service accounts and remote access tools have standing access to your network. Inventory third-party and MSP access as non-human and external identities with owners, scopes and expiry, and monitor their sign-ins. That turns T1590.003 findings into a controlled list rather than a target list.
Common failure patterns
- Descriptive hostnames: names such as fw-mgmt or vpn-admin advertise exactly what to attack.
- Open zone transfers: a legacy secondary or test server answers AXFR from anywhere.
- Exposed management planes: firewall and VPN admin pages reachable from the internet, as in the edge-device campaigns CISA describes.
- Forgotten domains and records: acquired company domains and stale cloud records nobody owns.
- Treating it as undetectable: teams skip T1590 entirely instead of measuring and shrinking exposure.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1590, T1590.001 to T1590.006; related T1592, T1595, T1596, T1199, T1133 | Technique, sub-techniques and follow-on stages |
| ATT&CK mitigations | M1056 Pre-compromise; M1054 Software Configuration (T1590.002) | Minimise exposed data; restrict zone transfers |
| NIST SP 800-53 Rev. 5 | CM-8, SC-7, AC-22, SC-20, SC-21, RA-5 | Inventory, boundary protection, publicly accessible content, secure DNS, vulnerability scanning |
| NIST CSF 2.0 | ID.AM-01, ID.AM-02, ID.RA-03, PR.PS-01 | Hardware and software inventory, threat identification, configuration management |
Practitioner checklist
- Keep an owned list of domains, IP blocks, ASNs and identity tenants.
- Restrict zone transfers to listed secondaries and test from outside.
- Remove stale DNS records and unneeded verification TXT records.
- Keep management interfaces off the internet.
- Monitor CT logs and external exposure for your domains and ranges.
- Remove unused verified domains from identity tenants and enforce phishing-resistant MFA.
- Inventory MSP and partner access with owners and expiry.
- Run a self-assessment quarterly and track the KPIs above.
Standards and references
- MITRE ATT&CK: Gather Victim Network Information (T1590)
- MITRE ATT&CK: Gather Victim Network Information: DNS (T1590.002)
- CISA: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
- Microsoft Learn: OpenID Connect on the Microsoft identity platform
- MITRE ATT&CK: AADInternals (S0677)
- MITRE ATT&CK: Pre-compromise (M1056)
- MITRE ATT&CK: Software Configuration (M1054)
Related NHI Mgmt Group resources: OSINT and Reconnaissance Guide · Certificate Transparency Monitoring Guide for Web Teams · DNS Security Guide · Attack Surface Management Guide · Discovery and Reconnaissance Techniques Guide