T1681Not expressible in Sigma

Search Threat Vendor Data

ReconnaissancePRE

Where this stands

No Sigma rule can address this — the telemetry MITRE names has no Sigma logsource behind it.

This happens on infrastructure you do not own, so it never reaches your logs. MITRE's own guidance is internet scanning and threat intelligence, not log analysis.

What the technique is

Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week. Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation. This technique is distinct from Threat Intel Vendors in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.

Read it on attack.mitre.org

What MITRE says you would watch

AN1998
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.