🔎MITRE ATT&CK: Tactic TA0043 - Pre attack phase - Reconnaissance

Reconnaissance is the research phase attackers use to learn everything they can about a target before they strike. It’s low-risk for the attacker but high-value: the more they know (people, tech stack, suppliers, exposures), the better their chances of a successful compromise. Think of it as the map-making stage of an attack — and good maps make for efficient, targeted operations.

🧭 What does Reconnaissance look like?

Reconnaissance includes any activity that helps an adversary build a picture of their target. It’s often divided into passive and active approaches:

• Passive Reconnaissance — gathering information without directly touching the target systems (e.g., public websites, social media, job postings, certificate transparency logs, DNS records, WHOIS, public code repositories, Shodan searches).

• Active Reconnaissance — interacting with the target or its infrastructure to discover live hosts or services (e.g., port scans, banner grabs, web crawling, probe requests).

Reconnaissance also includes human-focused techniques: social engineering, phishing reconnaissance (e.g., crafting spearphishing messages), dumpster diving, and mapping partner/supplier relationships.

⚙️ Common Types / Techniques (practical list)

• OSINT collection — harvesting public facts: company pages, LinkedIn, blog posts, vendor pages, news, certificates, DNS.

• Domain & DNS discovery — subdomain enumeration, zone transfers (misconfigured), DNS history.

• Service & port scanning — checking which services are exposed and their versions.

• Web application fingerprinting — identifying software (CMS, frameworks, plugins) and versions.

• Cloud & storage discovery — searching for exposed S3/Blob buckets, misconfigured cloud assets.

• Public code & secrets discovery — scanning GitHub/GitLab for leaked keys, config files, credentials.

• Third-party / supply-chain mapping — identifying vendors, contractors, and connections that expand attack surface.

• Social engineering / profile profiling — collecting employee roles, email formats, and behavioral cues to craft targeted lures.

• Search engine & crawler abuse — exploiting cached pages, error messages, or indexed debug information.

• Infrastructure reconnaissance — certificate transparency logs, WHOIS, ASN and IP range discovery.

• Open ports / exposed services discovery via Internet scanners — using tools like Shodan or Censys to find Internet-facing systems.
  

🔍 Short examples (how attackers use recon in real terms)

• An attacker finds an engineer’s email and a public GitHub repo with a forgotten API key → they use the key to probe a cloud service.

• Scanning reveals an outdated web app plugin; a follow-up exploit gives initial access.

• Job postings reveal an upcoming migration to a new ERP — attackers tailor phishing to mimic migration communications.

• WHOIS and certificate logs expose subdomains; subdomain takeover of an unused host is used for phishing.

• Supplier relationships are mapped; attackers compromise a small vendor to reach the primary target (supply-chain path).
  

🛡️ Recommendations — make reconnaissance harder and less useful

1) Reduce exposed information (attack surface reduction)

• Audit public-facing assets (domains, subdomains, cloud buckets) and remove or secure unused ones.

• Use DNS and certificate monitoring to detect unexpected subdomain creation.

• Avoid publishing detailed internal architecture, software versions, or build pipelines in public channels.

2) Protect secrets and public code

• Enforce strict code-review and secret-scanning (pre-commit and CI checks) to block leaked credentials or API keys.

• Rotate keys and credentials quickly; use short-lived credentials and managed identity services where possible.

3) Harden web and cloud footprints

• Keep web apps and components patched; minimize exposed services and restrict management interfaces to VPNs or jump hosts.

• Apply least-privilege to cloud storage and APIs; block anonymous or overly-broad ACLs on buckets and containers.

4) Monitor and detect reconnaissance activity

• Monitor for unusual DNS lookups, spikes in subdomain queries, and repeated reconnaissance-like probes (port sweeps, unusual user agents).

• Ingest OSINT and external threat feeds to learn when your organization or assets appear in public scans or leaks.

5) Raise human resilience

• Train employees to spot targeted pretexting and spearphishing that is informed by recon data (job changes, migration notices, contractor names).

• Limit posted employee details (avoid publishing direct email addresses on public pages; use contact forms or role-based addresses).

6) Secure third parties and supply chains

• Maintain an inventory of third parties and require security hygiene for vendors — rotate credentials and segment vendor access.

• Treat supplier exposure as part of your threat model: monitor vendor domains and their public footprints.

7) Deception & proactive counter-OSINT

• Use honeypots, fake subdomains, or deception DNS records to detect malicious reconnaissance and gather intelligence on attacker techniques.

• Consider registering likely typo-squatted domains to prevent attacker use.

8) Continuous red-team / purple-team verification

• Regularly run red-team and automated scanning exercises that emulate recon to validate detection and response.

• Use threat-modeling exercises to prioritize which publicly visible assets are most sensitive.
  

🔁 Final note

Reconnaissance is cheap for attackers and priceless for defenders — preventing or detecting it early can avert highly targeted attacks later. Make it harder to find useful information, monitor the signals that recon generates, and harden the human and supply-chain channels that attackers rely on to pivot from “research” to “access.”