Techniques › T1589 › AN1973
AN1973 Analytic 1973
PRE · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor for suspicious network traffic that could be indicative of probing for user information, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an adversary/botnet). Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.</p>
- Detects
- T1589 Gather Victim Identity Information
- Part of
- DET0841 Detection of Gather Victim Identity Information
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| Network Traffic | None | DC0085 Network Traffic Content |