{"id":"T1681","name":"Search Threat Vendor Data","url":"https://attack.mitre.org/techniques/T1681","tactics":["reconnaissance"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0866","stix_id":"x-mitre-detection-strategy--6b173b90-4b1d-4de8-a506-95b8b10921a7","name":"Detection of Search Threat Vendor Data","url":"https://attack.mitre.org/detectionstrategies/DET0866","analytics":[{"id":"AN1998","stix_id":"x-mitre-analytic--ac4bf64e-da14-4416-8961-f0736eb4d9be","name":"Analytic 1998","description":"Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.","url":"https://attack.mitre.org/detectionstrategies/DET0866#AN1998","platforms":["PRE"],"log_source_references":[],"mutable_elements":[],"live":true,"detection_strategies":["DET0866"],"techniques":["T1681"]}],"live":true,"version":"1.0","techniques":["T1681"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}