| Technique | Gather Victim Identity Information (T1589) |
| Tactic | Reconnaissance |
| Platforms | PRE |
Detection Playbooks
Daily MITRE ATT&CK-based detection playbooks covering common adversary techniques. Each playbook includes SIEM-agnostic detection logic and investigation and response guidance.
Detection Playbook: Virtualization/Sandbox Evasion (T1497)
Virtualization/Sandbox Evasion (T1497) describes a class of techniques where malware actively probes its execution environment to determine whether it is run…
Detection Playbook: Ingress Tool Transfer (T1105)
Ingress Tool Transfer (T1105) describes the technique where adversaries download or copy tools, scripts, or payloads from an external system they control int…
Detection Playbook: Exploit Public-Facing Application (T1190)
Exploit Public-Facing Application (T1190) describes adversaries gaining initial access by attacking a vulnerability — a software bug, misconfiguration, or un…
Detection Playbook: Drive-by Compromise (T1189)
Drive-by Compromise (T1189) is an initial access technique where an attacker causes a victim to gain code execution on their system simply by visiting a mali…
Detection Playbook: Exfiltration Over Alternative Protocol (T1048)
Exfiltration Over Alternative Protocol (T1048) describes adversaries stealing data by sending it out through a network protocol that differs from their prima…
Detection Playbook: Exfiltration Over C2 Channel (T1041)
Exfiltration Over C2 Channel (T1041) describes the technique where an adversary reuses an already-established command-and-control communication channel to sm…
Detection Playbook: Local Data Staging (T1074.001)
Local Data Staging (T1074.001) is the practice of collecting and consolidating files of interest — credentials, documents, database dumps, configuration file…
Detection Playbook: Archive via Utility (T1560.001)
Archive via Utility (T1560.001) describes adversaries using compression and archiving tools — such as tar , zip , 7-Zip , WinRAR , makecab , or certutil — to…
Detection Playbook: Data Destruction (T1485)
Data Destruction (T1485) is an impact-phase technique where adversaries deliberately overwrite, corrupt, or permanently delete files and data to make recover…