T1592 Gather Victim Host Information: Detection, Mitigation and Response

Before choosing an exploit, an attacker wants to know what you run: the server software and version behind a login page, the browser and operating system your staff use, and the security products on their machines. MITRE ATT&CK T1592 Gather Victim Host Information (tactic Reconnaissance, TA0043) covers collecting those host details, through scanning, phishing, compromised websites that fingerprint visitors, and public documents such as job adverts and invoices. Most of it happens outside your network, so the defensive work is exposure reduction, keeping what is visible current, and watching for the infrastructure that collects fingerprints. This guide covers the four v20 sub-techniques, real cases, banner, user agent and software fingerprint leakage with the actual server settings, what you can detect, and how to test. It is for infrastructure and web platform engineers, vulnerability managers and threat intelligence analysts. For identity data gathered in the same phase, see the MITRE ATT&CK T1589 Gather Victim Identity Information guide.

Key takeaways

• Host information picks the exploit. ATT&CK describes T1592 data as revealing opportunities for T1587 Develop Capabilities, T1588 Obtain Capabilities, T1195 Supply Chain Compromise and T1133 External Remote Services.
• Two collection routes, two defences. Your servers leak through banners and responses; your staff's browsers leak when they visit attacker-controlled or compromised sites that fingerprint visitors.
• Hiding versions helps a little, patching helps a lot. Apache's own documentation says disabling the Server header does nothing to make a server more secure; trim banners, but rely on current versions.
• Detection is mostly external. MITRE's detection strategies point to internet scanning for fingerprinting content (data component DC0104 Response Content) and to later stages, not to your own logs.
• Documents leak hosts too. ATT&CK names job postings, network maps, assessment reports, resumes and purchase invoices as sources for firmware and hardware details.

What ATT&CK v20 says T1592 covers

ATT&CK describes T1592 as gathering administrative data about hosts (name, assigned IP, functionality) and configuration details (operating system, language and similar). Collection routes named are T1595 Active Scanning, T1598 Phishing for Information, compromising websites to run content that collects host information from visitors, and online data sets such as social media and the victim's own websites. The platform is PRE.

The only v20 mitigation is M1056 Pre-compromise: minimise the amount and sensitivity of data available to external parties.

How adversaries use it: cases

• Fingerprinting visitors (Andariel, G0138): ATT&CK records Andariel inserting a malicious script into compromised websites to collect visitor details such as browser type, system language and Flash Player version (T1592.002).
• User agents from phishing sites (Magic Hound, G0059): ATT&CK records the group capturing user agent strings from visitors to its phishing sites.
• ScanBox on a fake news site: Proofpoint reported that between April and mid-June 2022 an actor it tracks as TA423 / Red Ladon (which it associates, with moderate confidence alongside PwC, with names including APT40 and Leviathan) sent phishing links to a site posing as an Australian news outlet. The site served the ScanBox framework, which collected the user agent, operating system, browser language, screen size, installed plugins, Java and ActiveX versions and a check for a specific security product.
• Pre-compromise host research (Volt Typhoon, G1017): ATT&CK and CISA advisory AA24-038A describe the actors researching host, identity and network details before compromise, and CISA cites industry reporting that they query FOFA, Shodan and Censys for exposed infrastructure.
• Cloud tenant details (HAFNIUM, G0125): ATT&CK records HAFNIUM interacting with Office 365 tenants to gather details about target environments (T1592.004).
• AI-orchestrated collection: ATT&CK v20 records the Anthropic AI-orchestrated Campaign (C0062) using an AI coding agent to catalogue services on discovered endpoints and gather details of high-value systems such as databases and workflow orchestration platforms.

Banner, user agent and software fingerprint leakage

Three kinds of leakage give away host details without anyone breaking in.

Server banners and response headers

Web servers announce themselves in the Server response header and on default error pages. Each common server has a documented setting.

Two cautions from the vendors themselves. Apache recommends not setting ServerTokens below Minimal because it makes interoperability problems harder to debug, and states plainly that disabling the Server header does nothing to make the server more secure. nginx's option to replace or empty the header entirely is listed as part of its commercial subscription. The practical reading: trim version strings because they make mass targeting easier, but measure success by patch currency, not by what the banner says. For the full server baseline see the Apache HTTP Server Hardening Guide.

Other response leaks (NHI Mgmt Group recommendation): framework and language headers added by application stacks, default error and stack trace pages, version paths in static asset URLs, and product login pages that print a build number. Review them in the same pass as the Server header.

User agents and client fingerprints

Every request your staff's browsers make carries a User-Agent string, and scripts can query far more, as ScanBox showed. Chrome's User-Agent reduction trims the default string to high-level browser and major version information, and moves platform version, full version list, device model and CPU architecture into high-entropy User-Agent Client Hints (Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Arch). A site has to request these with an Accept-CH header, they are sent only over HTTPS, and the browser decides what to return. That reduces passive leakage, but a site the user visits can still ask, so the real defence is that the fingerprint reveals nothing old: managed, auto-updating browsers and removal of legacy plugins and runtimes. See the Browser Security Hardening Guide.

Documents and public artefacts

• Job adverts: exact firewall, VPN, EDR and SIEM products and versions, as ATT&CK notes for T1592.002 Software.
• Published assessment reports and network maps: often attached to tenders, grant applications or conference talks.
• Procurement records and invoices: hardware models and support contracts.
• Public code and container images (NHI Mgmt Group recommendation): dependency manifests and image tags reveal software versions; build files can also reveal service account names and token variable names, which links host reconnaissance to non-human identity targeting.

Where identity fits

Host details help attackers decide which identity to steal and where. A fingerprinted VPN or single sign-on appliance version tells them whether a known session-token or credential-leak flaw applies. HAFNIUM's tenant interaction shows cloud identity configuration is host information too. And software versions in public repositories sit next to the machine credentials those pipelines use; scan for both. See the Developer Secret Scanning Triage guide.

What you can detect

MITRE's analytics for DET0826 and the sub-technique strategies say internet scanners may be used to look for patterns associated with malicious content designed to collect host information from visitors, and that much of the activity has a high false positive rate and takes place outside the target's visibility. The data component they reference is DC0104 Response Content from internet scan data. That gives two useful places to look, plus your own edge.

For the external view of your own estate, see the Attack Surface Management Guide.

Measures that show it is working

• Banner exposure: percentage of internet-facing web services returning a full version string (target near zero).
• Patch currency on exposed hosts: percentage of internet-facing systems on a supported, current version.
• Browser currency: percentage of managed browsers on the latest stable release within 7 days of release.
• Document leaks closed: public documents found with product versions, network maps or invoices, and time to removal.
• Fingerprinting intelligence actioned: number of reported fingerprinting sites blocked at the web proxy and DNS layer.

How to implement and test

1. Inventory exposed hosts: list every internet-facing service from your asset inventory and an external scan; reconcile the two. See the Asset Inventory and CMDB Security Guide.
2. Baseline what each one reveals: record Server and framework headers, error pages and login page build numbers from outside your network, under written authorisation for any third-party hosted service.
3. Change banners in a pilot ring: apply ServerTokens Prod, server_tokens off or removeServerHeader to non-production first, check monitoring and load balancer health checks that may match on headers, then roll out.
4. Roll back: each change is a single configuration line; revert it if a dependent tool breaks, and fix the dependency rather than keeping the version string.
5. Harden browsers: enforce auto-update, remove legacy plugins and runtimes, and block newly registered and uncategorised domains at the proxy where your risk appetite allows.
6. Review documents: add a security check to job advert templates, tender submissions and public talks.
7. Re-test quarterly: repeat step 2 and compare; add new exposures to the vulnerability management queue.

Small organisations get most of the value from steps 1, 3 and 5. Larger ones should automate step 2 through an attack surface management service and track the measures above per business unit.

Common failure patterns

• Treating banner removal as patching: Apache's documentation is explicit that hiding the header does not make a server safer; scanners test for the flaw directly.
• Fixing the web server but not the appliance: VPN and gateway login pages often print the product build; those are the hosts most targeted after a new advisory.
• Legacy runtimes left in browsers: ScanBox checked for Java and ActiveX versions because old components are the easiest to exploit.
• Job adverts as a product inventory: listing exact security tools and versions hands over T1592.002 and T1592.003 for free.
• No owner for public documents: network diagrams in tender packs and conference slides stay online for years.

Framework mapping

Practitioner checklist

• Set ServerTokens Prod on Apache, server_tokens off on nginx and removeServerHeader="true" on IIS 10.0.
• Replace default error and stack trace pages on every internet-facing application.
• Remove build numbers from VPN, SSO and gateway login pages where the product allows.
• Track patch currency on exposed hosts as the primary measure, not banner state.
• Enforce browser auto-update and remove legacy plugins and runtimes.
• Feed threat intelligence on fingerprinting sites into proxy and DNS blocking.
• Add a security review to job adverts, tenders and public talks.
• Scan public repositories and images for version data and secrets together.

Standards and references

• MITRE ATT&CK: T1592 Gather Victim Host Information
• MITRE ATT&CK: T1592.002 Software
• Apache Software Foundation: Apache HTTP Server 2.4 core features (ServerTokens, ServerSignature)
• nginx: Module ngx_http_core_module (server_tokens)
• Microsoft Learn: IIS Request Filtering (removeServerHeader)
• Chrome for Developers: User-Agent reduction and User-Agent Client Hints
• CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• Proofpoint: Chasing the Currents of Espionage in the South China Sea

Related NHI Mgmt Group resources: Attack Surface Management Guide, OSINT and Reconnaissance Guide, MITRE ATT&CK T1598 Phishing for Information, Edge Device Exploitation by Threat Actors Guide.