Gather Victim Org Information: recognize the technique

Lesson Purpose

What you are learning

This technique is about learning how an organization works. Public information may include business units, leaders, offices, suppliers, partners, technologies, projects, and schedules. Each fact may be harmless by itself, but several facts can be combined to support later targeting. This can help an attacker choose people, systems, or business processes to target.

Learning Objectives

Explain Gather Victim Org Information in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Organizations publish information for customers, hiring, investors, and partners. Defenders should review whether public details are still needed and whether they reveal more about operations than intended. In practice, defenders compare public information with internal records, logs, inventories, and monitoring data to decide whether the information is current, expected, and useful to an attacker. The goal is not to remove all public information, but to reduce unnecessary exposure and review information that could create avoidable security risk.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Learn the Concept

Why Public Organization Details Matter

Public organizational information can help someone understand how a company works before they ever interact with its systems. Useful details can include people and leadership, offices and business units, suppliers and partners, technologies and projects, and schedules or operational relationships.

A single public fact may be harmless. Risk increases when several facts can be combined to reveal who has access, which technology is used, who works with whom, or when important activity occurs.

Defenders therefore review whether a public detail is necessary for its intended audience and whether it reveals more operational context than needed.

Example

People/leadership information can help identify likely roles or decision makers.
Technology/project information can reveal products, platforms, or initiatives.
Supplier/partner information can reveal trusted business relationships.

What you should take away: Useful controls include publication review, data minimization, removing stale information, and avoiding unnecessary internal technology or operational detail.

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Public organizational information can include people and leadership, business units and offices, suppliers or partners, technologies and projects, and schedules or operational relationships.
Before publishing, ask whether the detail is necessary for the intended audience and whether combining it with other public facts could reveal sensitive operational context.
Reduce unnecessary detail through publication review, data minimization, removal of stale material, and limiting internal technology or operational specifics that do not need to be public.

This is ungraded practice. Use the lesson material above; exact wording is not required. Name three types of public organization information that could matter to security. Then give one review question and two controls that limit unnecessary operational detail. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Gather Victim Org Information? This technique is about learning how an organization works. This technique is about learning details about systems linked to an organization. This technique is about using public internet sources to learn about a target.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Public websites, organization charts, supplier information, recruiting material, and impersonation reports Asset inventories, vulnerability data, cloud records, service banners, and configuration records Public website reviews, code-repository scanning, search-engine exposure checks, and data-loss alerts

3. Which interpretation best avoids overstating what the observed information proves? Normal business information can become security-relevant when several public facts are combined. Host information is more useful when several observations are combined. Defenders should validate it and reduce unnecessary exposure. Public information is useful but may be incomplete. Defenders should manage what they publish and protect sensitive systems without relying on secrecy.

4. Consider this behavior: This technique is about learning how an organization works. Public information may include business units, leaders, offices, suppliers, partners, technologies, projects, and schedules. Which ATT&CK technique best matches the behavior? Gather Victim Org Information Gather Victim Host Information Search Open Websites and Domains

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Review public information before publication and independently verify sensitive requests that use real company details Verify the system and software details against current inventory, then restrict unnecessary public services and admin interfaces Review public content and repositories for secrets or unnecessary details, then remove or rotate sensitive material

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? A public business fact may be harmless alone but more useful when combined with other facts A public host detail may be old, incomplete, or unrelated to the organization's current systems Public information can be legitimate, incomplete, or outdated

Learning Moment

Normal business information can become security-relevant when several public facts are combined. Defenders should confirm context with more than one source and reduce unnecessary exposure where practical.

Defender Perspective

Useful sources include public websites, organizational charts, supplier information, recruiting material, press releases, social-media guidance, and reports of impersonation. Check whether details are current, necessary, and accurate. Reduce risk with publication review, data-classification guidance, third-party verification, and independent checks for sensitive requests. Risk reduction includes reviewing what is exposed and using controls to limit information that is not needed.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard