Search open technical databases (T1596)

What is search open technical databases (T1596)?

Search open technical databases (T1596) is a MITRE ATT&CK® reconnaissance technique in which adversaries query publicly accessible technical databases to gather detailed information about a target organization's internet-facing infrastructure without interacting with the target directly. Unlike active scanning (T1595) where the attacker probes infrastructure and generates detectable traffic, T1596 exploits the fact that third-party services continuously index the internet and make the results searchable to anyone.

The intelligence gathered through T1596 is operationally equivalent to conducting a comprehensive external network scan, but without generating any log entries on target systems, without exposing attacker IP addresses to target perimeter devices, and without triggering any IDS/IPS signatures. This is why T1596 is strategically preferred by advanced persistent threat actors who prioritize operational security.

How attackers use open technical databases

Open technical database reconnaissance follows a structured workflow that produces a complete target profile without generating a single event in the target's security stack:

1. Attack surface enumeration via Shodan/Censys: Adversaries begin by querying Shodan or Censys for the target organization's IP ranges, ASN, or domain name. These queries return a complete inventory of internet-facing services (every open port, every service banner, every TLS certificate, and every HTTP response header) without the attacker sending a single packet to the target. For organizations with large internet footprints, this can reveal dozens of exposed services that security teams may not be fully aware of.
2. Vulnerability identification from catalogued service versions: Shodan and Censys capture service banner information including software version strings. Adversaries cross-reference identified service versions against the CVE database and public exploit repositories (Exploit-DB, GitHub PoC repositories) to instantly identify which exposed services are running vulnerable versions. This transforms raw infrastructure data into a prioritized exploitation target list without any active probing. Enriching these findings with threat intelligence further accelerates attacker prioritization.
3. Subdomain enumeration via certificate transparency: Certificate transparency (CT) logs, publicly auditable records of all issued SSL/TLS certificates, are queried via services like crt.sh, Facebook CT, and Google Transparency Report. CT logs reveal every subdomain for which a certificate has ever been issued, including internal-use subdomains, staging environments, developer panels, and partner portals that may not appear in public DNS. These shadow subdomains are often inadequately hardened and represent attractive secondary targets.
4. Historical infrastructure mapping via passive DNS: Passive DNS databases record historical DNS resolution data, allowing adversaries to see IP addresses that a domain previously resolved to. This reveals changes in hosting infrastructure, formerly external-facing services that were moved internal, and IP address blocks associated with the organization's historical infrastructure that may still be accessible. Passive DNS reconnaissance also identifies CDN and DDoS mitigation services in use, which can reveal the true origin IP behind services protected by Cloudflare or Akamai.
5. Ownership and contact data via WHOIS: WHOIS queries against domain registration records and IP ARIN/RIPE/APNIC registries reveal registrant contact details, organization names, administrative contacts, and corporate email patterns. WHOIS data correlates with T1589 identity reconnaissance by confirming organizational identity and providing contact information for phishing attack pretexts.

Sub-techniques

MITRE ATT&CK documents five T1596 sub-techniques representing distinct open database categories:

• T1596.001 — DNS/Passive DNS: Querying passive DNS databases to retrieve historical domain-to-IP mappings, revealing changes in hosting infrastructure, formerly public services, and IP ranges associated with the organization. Passive DNS data is particularly useful for identifying real origin IPs behind CDN services and historically exposed internal addresses.
• T1596.002 — WHOIS: Querying WHOIS registries for domain registration records and IP ownership data. Returns organizational identity, administrative contacts, registration dates, name server configurations, and registrar details. WHOIS data correlates network infrastructure to organizational identity and provides contact details usable in social engineering operations.
• T1596.003 — Digital Certificates: Querying certificate transparency logs to enumerate SSL/TLS certificates issued for target domains and subdomains. Reveals the full scope of the organization's certificate-protected infrastructure, including staging environments, developer portals, and internal services that appear in CT logs despite not being publicly linked.
• T1596.004 — CDNs: Identifying content delivery network configurations to determine the real origin infrastructure behind CDN-protected services, understand caching and routing configurations, and map partner and vendor relationships visible in CDN configuration records. CDN reconnaissance can reveal organization-to-CDN IP mappings that bypass DDoS protection and content-based access controls.
• T1596.005 — Scan Databases: Querying Shodan, Censys, and equivalent internet scan databases for pre-collected information about target IP ranges and services. This is the most operationally impactful sub-technique because it provides service-version intelligence enabling immediate CVE-to-target matching without requiring active scanning activity.

Detection approach

T1596 reconnaissance occurs entirely on third-party database platforms and generates zero events in the target organization's security monitoring stack at collection time. Detection requires monitoring the downstream consequences: the exploitation attempts, authentication probes, and targeted attacks that follow when adversaries act on their T1596-gathered intelligence:

IPS event correlation for Shodan-catalogued service exploitation

When adversaries use T1596 Shodan reconnaissance to identify vulnerable services, the follow-on exploitation attempt against those services will generate IPS events on perimeter devices. Log360 collects and correlates IPS events from Cisco FTD, Fortinet FortiGate, and SonicWall, using rules like Cisco FTD Intrusion Event Detected, Generic Attacks Detection (Fortinet), and Fortinet Appliance Auth bypass to detect exploitation activity targeting specifically those service types that Shodan databases prominently catalogue: web applications, VPN endpoints, network appliances, and exposed admin interfaces.

CVE exploitation signature matching

T1596.005 reconnaissance against Shodan provides adversaries with specific service versions to exploit. When a new CVE is published for a catalogued service version, exploit attempts against targets running that version typically begin within hours to days. Log360's CVE-specific detection rules (for example, CVE-2023-22518 Exploitation Attempt - Confluence and Potential MOVEit Transfer CVE-2023-34362) detect these targeted exploitation attempts at the Windows endpoint or perimeter device level, capturing the operationalization of intelligence gathered from Shodan vulnerability cataloguing.

Certificate transparency-identified subdomain targeting

Subdomains enumerated through T1596.003 certificate transparency reconnaissance are commonly targeted for authentication attacks and web application exploitation. Log360's web server process anomaly rules (Suspicious Process By Web Server Process, Webshell Hacking Activity Patterns) detect exploitation of these secondary subdomains if they run Windows-based web services. For network-layer detection, perimeter device IPS events covering web application attacks provide coverage for CT log-identified subdomains accessible through the perimeter.

New service exposure monitoring

Shodan continuously re-scans internet-facing infrastructure and updates its catalogue. Organizations can reduce T1596 operational impact by monitoring their own profile in open databases, identifying newly exposed services as soon as they appear in Shodan or Censys catalogs, before adversaries discover them. While this is not a Log360 detection capability, it complements Log360's downstream event detection with proactive exposure management.

Log360 detection capabilities

Log360 detects T1596 downstream exploitation activity through IPS event correlation, CVE-specific exploitation rules, and web application attack detection:

Investigation steps

When Log360's IPS or CVE detection rules fire on events that may represent T1596-driven targeted exploitation, the investigation should establish whether the attacker had specific prior intelligence about the target service and assess the exploitation success:

1. Determine if the targeted service is catalogued in open databases: As part of the threat investigation, query Shodan and Censys for the targeted service's IP and port to understand what pre-built intelligence an attacker would have had. If the service appears in Shodan with the exact version that the exploit targets, this confirms T1596 reconnaissance is the likely intelligence source. The attacker did not need to scan to know this service was exploitable.
2. Characterize the attack specificity: Examine the IPS event signatures that fired. Generic port sweep signatures indicate opportunistic scanning (T1595). CVE-specific probe signatures, versioned exploit payloads, or application-specific attack patterns indicate targeted exploitation of a known vulnerable version, consistent with T1596 pre-reconnaissance that identified the specific version before the exploit attempt. Use anomaly detection baselines to distinguish targeted from opportunistic patterns.
3. Check for pre-attack reconnaissance correlation: Review perimeter device logs for activity from the same source IP in the 24-48 hours preceding the exploit attempt. T1595 active scanning from the same source before exploitation indicates a combined reconnaissance-then-exploitation workflow. An exploit attempt with no preceding active scanning from the same source suggests T1596 passive database reconnaissance was used instead to avoid generating pre-attack detection events.
4. Assess the blast radius of certificate transparency-identified targets: If the targeting involves subdomains identified through CT log enumeration (rather than primary production hosts), audit the security posture of all organization subdomains visible in CT logs. Staging environments, developer tools, and legacy subdomains found in CT logs are frequently running outdated software versions and may have weaker access controls than primary production infrastructure.
5. Review for multi-service exploitation patterns: T1596 reconnaissance against Shodan produces a prioritized list of multiple exploitable services, not just one target. After detecting exploitation of one service, review IPS logs for concurrent or recent exploitation attempts against other perimeter services; a multi-service exploitation sequence indicates a deliberate attack campaign using a complete T1596-derived target list rather than opportunistic single-service probing. Subsequent stages often involve lateral movement once initial access is achieved.

Response playbook

• Immediately audit your Shodan/Censys exposure profile: Query Shodan (shodan.io) and Censys for your organization's IP ranges, ASN, and domain. The results represent exactly what attackers see when researching your infrastructure. Identify any services that should not be internet-facing, any services running known-vulnerable versions, and any unexpected exposures that IT/security teams were not aware of. This converts T1596 intelligence from an attacker advantage to a defensive advantage.
• Patch or remediate all Shodan-visible vulnerable services immediately: Services running CVE-vulnerable versions that are catalogued in open databases have an extremely short exploitation window after CVE disclosure. Prioritize patching for all internet-exposed services identified in your Shodan/Censys profile over internal services, as external exposure combined with version cataloguing creates an immediate exploitation opportunity for T1596-savvy adversaries.
• Remove unnecessary internet-facing services: Any service that appears in your Shodan profile but does not need to be internet-accessible should be immediately moved behind a VPN, zero-trust access proxy, or firewall allowlist. Management interfaces (admin panels, SSH, RDP, database ports), monitoring tools, and developer services are commonly inadvertently exposed and appear prominently in Shodan results for targeted organizations.
• Audit certificate transparency exposure: Query crt.sh for your organization's domains to retrieve the complete list of SSL/TLS certificates and the subdomains they were issued for. Audit each subdomain for security posture, particularly legacy subdomains, staging environments, and partner portals. Decommission or harden subdomains that should no longer be publicly accessible but remain resolvable and certificate-issued.
• Implement Shodan Monitor alerting: Configure Shodan Monitor (or equivalent) for your organization's IP ranges to receive real-time notifications when new services appear in the Shodan catalog. A new exposed service should trigger the same security response as a CVE alert, immediate assessment and remediation before adversaries discover it in T1596 reconnaissance queries.
• Strengthen IPS sensitivity for catalogued service types: After confirming that targeted services appear in open databases, increase IPS sensitivity levels in Log360 for the relevant Cisco, Fortinet, or SonicWall rule categories covering those service types. Accepting higher false positive rates for the specific attack patterns against your most Shodan-exposed services is justified by the elevated targeting risk those services represent. Review published detection rules to ensure your rule set reflects the latest CVE-targeted attack patterns.

Need to explore ManageEngine Log360? Schedule a personalized demo

Frequently asked questions