Attack scenario
Reconnaissance and attack surface mapping
An adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
Why this scenario matters
The scenario includes passive information gathering and active scanning. It may produce a list of identities, domains, services, devices, cloud accounts, and vulnerable interfaces that the adversary can use for phishing or technical intrusion.
Early attack-surface visibility helps remove unknown assets, misconfigurations, and unnecessarily exposed services before an adversary discovers them.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Discovery
- Reconnaissance
Relevant ATT&CK techniques
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.