Search Closed Sources: recognize the technique

Lesson Purpose

What you are learning

This technique is about getting information from sources that are not freely available to everyone. Examples include paid databases, subscription services, commercial data, or other restricted information services. Using a paid source is not automatically malicious. These sources can add details that are not visible on ordinary public websites and may make other information more useful.

Learning Objectives

Explain Search Closed Sources in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Organizations also use commercial data for security and business purposes. Defenders should know what company information third parties hold and how that information is shared. In practice, defenders compare public information with internal records, logs, inventories, and monitoring data to decide whether the information is current, expected, and useful to an attacker. The goal is not to remove all public information, but to reduce unnecessary exposure and review information that could create avoidable security risk.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Paid or restricted sources may contain commercial contact data, organizational relationships, technical/asset data, breach or credential exposure information, or other aggregated records.
Govern third-party information through vendor/data-governance review: know what is collected, why it is shared, who can access it, and how long it is retained.
Reduce exposure through data minimization, contractual/access controls, retention limits, and periodic review of third-party holdings.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three types of information that might appear in paid or restricted sources. Then name one process that helps govern that information and two controls that reduce unnecessary exposure. No external source access is required. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Search Closed Sources? This technique is about getting information from sources that are not freely available to everyone. This technique uses deceptive messages to persuade someone to reveal information. This technique is about using information from security vendors, researchers, and intelligence providers.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Provider notifications, third-party risk records, data-sharing inventories, exposure reports, and threat-intelligence feeds Email headers, sender-authentication results, secure-email events, link destinations, and reported messages Threat-intelligence feeds, vendor advisories, exposure reports, asset inventories, SIEM data, and incident records

3. Which interpretation best avoids overstating what the observed information proves? Defenders should understand where organizational information exists outside systems they directly control. A message does not need malware to be dangerous. Verify the sender and sensitive requests through trusted channels. Threat-vendor data is useful context, not proof. Combine it with current internal evidence.

4. Consider this behavior: This technique is about getting information from sources that are not freely available to everyone. Examples include paid databases, subscription services, commercial data, or other restricted information services. Which ATT&CK technique best matches the behavior? Search Closed Sources Phishing for Information Search Threat Vendor Data

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Track what information third parties hold and use vendor governance and data-minimization controls Verify the sender through a trusted independent channel before sharing sensitive information Check whether the report applies to current organizational assets and confirm it with internal evidence

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? The use of a commercial or restricted data source is not automatically malicious A message can create risk even when it contains no malware A vendor report does not automatically prove that the organization is exposed or compromised

Learning Moment

Defenders should understand where organizational information exists outside systems they directly control.

Defender Perspective

Useful sources include provider notifications, exposure-monitoring reports, third-party risk records, data-sharing inventories, identity exposure reports, and threat-intelligence feeds. Check what information a third party holds, whether it is accurate, and whether sharing is authorized. Reduce risk with vendor governance, data minimization, contractual controls, and credential monitoring.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard