T1596.005 Scan Databases

Technique: T1596.005
Tactics: Reconnaissance
Research, 90 days: 4
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 0
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1596/005

MITRE description

Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan) Adversaries may search scan databases to gather actionable information. Threat actors can use online resources and lookup tools to harvest information from these services. Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
2026-09-25 Google Threat Intelligence: ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft
2026-08-25 Group-IB: Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
2026-08-19 Group-IB: Balonx Sistema: The Face Behind the PhaaS Affecting Mexican Banking

Detection coverage

Coverage data unavailable in this snapshot (community inventory not yet ingested).

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.