Attack scenario
Shadow and zombie APIs without managed inventory
Unknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.
Why this scenario matters
The adversary discovers subdomains, old endpoints, test environments, alternate hosts, and versions. A zombie API may use weaker authentication, an old schema, a vulnerable library, or bypass the gateway and central security policy.
Controls require continuous API discovery, an owner- and lifecycle-aware inventory, comparison of documentation with observed traffic, managed version retirement, and monitoring of unexpected endpoints.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Discovery
- Initial Access
- Reconnaissance
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.