T1590 Gather Victim Network Information

Technique

T1590

Tactics

Reconnaissance

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

2

Elastic, Splunk

4

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1590

MITRE description

Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, etc.) as well as specifics regarding its topology and operations. Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)).(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-21 Flare: Measuring Credential Exposure of Contractors and Integrators After the Refrigeration System Attack in France: 601 Industrial Remote Access Addresses Recovered From Stealer Logs, 73% on the Largest Platform Paired With Device Credentials

Detection coverage

SigmaHQ community rules

• PUA - Advanced IP/Port Scanner Update Check (core)
• Suspicious DNS Query for IP Lookup Service APIs (core)

Elastic and Splunk rules

• Spike in Firewall Denies (elastic)
• Cisco IOS XE Reconnaissance Command Activity (splunk)
• Local LLM Framework DNS Query (splunk)
• Windows WinPEAS PowerShell Script Execution (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.