T1590

Gather Victim Network Information

Reconnaissance Last updated:

This detection identifies adversary reconnaissance activity targeting victim network information, including IP ranges, domain names, DNS records, network topology, and security appliance configurations. Because T1590 is a PRE-ATT&CK technique, direct detection within the victim environment is limited; however, second-order indicators are observable when adversaries deploy internal network enumeration tools post-compromise (as seen with Volt Typhoon, Indrik Spider, and HAFNIUM), attempt DNS zone transfers, execute WHOIS or DNS enumeration utilities, or run network discovery tools such as Lansweeper and Advanced IP Scanner. Detection focuses on process execution of known network reconnaissance binaries, DNS zone transfer attempts, and anomalous internal network topology queries that suggest an adversary mapping the environment for lateral movement or targeting.

What is T1590 Gather Victim Network Information?

Gather Victim Network Information (T1590) maps to the Reconnaissance tactic — the adversary is trying to gather information they can use to plan future operations in MITRE ATT&CK.

This page provides production-ready detection logic for Gather Victim Network Information, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Reconnaissance
Technique
T1590 Gather Victim Network Information
Canonical reference
https://attack.mitre.org/techniques/T1590/
Microsoft Sentinel / Defender
kusto 
let NetworkReconTools = dynamic(["nmap", "masscan", "zmap", "lansweeper", "angryip", "fping", "nbtscan", "netdiscover", "unicornscan", "dnsenum", "dnsrecon", "fierce", "sublist3r", "amass", "theharvester", "advanced_port_scanner", "advanced ip scanner"]);
let DnsReconPatterns = dynamic(["axfr", "AXFR", "zone-transfer", "zone transfer", "-t ANY", "ls -d"]);
let NetworkCmdRecon = dynamic(["ipconfig /all", "nslookup", "arp -a", "netstat -ano", "route print", "net view", "nltest /dclist", "nltest /domain_trusts"]);
DeviceProcessEvents
| where TimeGenerated > ago(1d)
| where (
    FileName has_any (NetworkReconTools)
    or ProcessVersionInfoOriginalFileName has_any (NetworkReconTools)
    or ProcessCommandLine has_any (NetworkReconTools)
    or ProcessCommandLine has_any (DnsReconPatterns)
    or (FileName in~ ("nslookup.exe", "dig.exe", "host.exe") and ProcessCommandLine has_any (DnsReconPatterns))
    or (FileName in~ ("nltest.exe") and ProcessCommandLine has_any ("/dclist", "/domain_trusts", "/trusted_domains", "/dsgetdc"))
)
| extend ReconCategory = case(
    ProcessCommandLine has_any ("nmap", "masscan", "zmap", "fping", "nbtscan"), "PortHostScanning",
    ProcessCommandLine has_any ("dnsenum", "dnsrecon", "fierce", "axfr", "AXFR", "zone-transfer"), "DNSEnumeration",
    ProcessCommandLine has_any ("lansweeper", "advanced_port_scanner", "angryip", "netdiscover"), "NetworkDiscoveryTool",
    ProcessCommandLine has_any ("/dclist", "/domain_trusts", "/trusted_domains"), "DomainTrustEnumeration",
    "GeneralNetworkRecon")
| extend SuspicionScore = case(
    ReconCategory == "PortHostScanning", 90,
    ReconCategory == "DNSEnumeration", 85,
    ReconCategory == "NetworkDiscoveryTool", 80,
    ReconCategory == "DomainTrustEnumeration", 70,
    50)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReconCategory, SuspicionScore
| order by SuspicionScore desc, TimeGenerated desc

Detects execution of known network reconnaissance binaries (nmap, masscan, Lansweeper, dnsrecon, fierce, etc.), DNS zone transfer attempts via nslookup/dig with AXFR queries, and domain trust enumeration via nltest. Scores findings by category to prioritize active port scanners and DNS enumeration over lower-confidence signals.

medium severity medium confidence

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Legitimate network administrators running nmap or Advanced IP Scanner for asset inventory or troubleshooting
  • IT operations teams using Lansweeper or similar tools for scheduled network discovery and CMDB updates
  • DNS administrators performing authoritative zone transfers between primaries and secondaries as part of normal operations
  • Security teams running authorized vulnerability scans or penetration tests using tools like nmap or masscan
  • nltest calls from legitimate domain join operations, group policy processing, or identity management tools

Sigma rule & cross-platform mapping

The detection logic for Gather Victim Network Information (T1590) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1590 Sigma rules on detection.fyi

Platform-specific guides for T1590

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-14 Research depth: deep
References (5)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Nmap Internal Subnet Port Scan

    Expected signal: Sysmon EventCode 1 (process create) with Image=nmap.exe, CommandLine containing the subnet range. Sysmon EventCode 3 (network connect) showing connections from nmap.exe to multiple internal IPs on specified ports. DeviceProcessEvents and DeviceNetworkEvents telemetry in MDE.

  2. Test 2DNS Zone Transfer Attempt via nslookup

    Expected signal: Sysmon EventCode 1 with Image=nslookup.exe, CommandLine containing 'AXFR' and the target domain. Windows DNS debug log (if enabled) will show an AXFR request from the client IP. DeviceProcessEvents in MDE captures the command line.

  3. Test 3Domain Trust Enumeration via nltest

    Expected signal: Sysmon EventCode 1 (process create) for each nltest invocation with the respective flags in CommandLine. SecurityEvent EventID 4688 if process command line auditing is enabled via GPO. DeviceProcessEvents in MDE with full command line captured.

  4. Test 4Internal Network Discovery with Advanced IP Scanner

    Expected signal: DeviceFileEvents showing advanced_ip_scanner.exe created in C:\Temp. Sysmon EventCode 11 (file create) for the binary. Process creation event for advanced_ip_scanner.exe. Network connection events to multiple internal IPs during scan. DeviceNetworkEvents in MDE showing mass internal connections.

Response Playbook

Triage

  1. Step 1: Identify the user account and device that executed the reconnaissance tool. Determine if the account is a service account, administrator, or standard user — standard users running nmap or dnsrecon is an immediate red flag.
  2. Step 2: Check the parent process of the reconnaissance binary. If spawned by cmd.exe, powershell.exe, or a web server process (w3wp.exe, httpd), escalate immediately. Legitimate admin tools are typically launched interactively from explorer.exe or a terminal emulator.
  3. Step 3: Correlate the timestamp with recent authentication events on that device. Query DeviceLogonEvents or SecurityEvent (EventID 4624/4648) for unusual logons in the preceding 30 minutes, especially from remote IPs or non-standard logon types.
  4. Step 4: Review the command-line arguments of the recon tool to determine scope. Wide-range subnet scans (e.g., /16 or /8 ranges), AXFR zone transfer attempts against internal DNS, or nltest /domain_trusts indicate systematic network mapping consistent with APT pre-lateral-movement activity.
  5. Step 5: Check if the reconnaissance binary was recently dropped to disk. Query DeviceFileEvents for the creation of the binary within the last 24-72 hours. A freshly-created nmap.exe or dnsrecon.py in a user temp or appdata path strongly indicates adversary staging.
  6. Step 6: Search for related network connections from the same device around the same time using DeviceNetworkEvents. Look for outbound connections to multiple internal IPs on common service ports (22, 80, 443, 445, 3389, 5985) within a short time window, consistent with port scan results being acted upon.
  7. Step 7: Review whether this activity was pre-authorized. Cross-check with your change management or pentest schedule. If no authorized scan is documented, treat as a potential incident.

Containment

  1. If the recon binary was dropped by a remote process or spawned from an unexpected parent, isolate the affected endpoint immediately using Defender for Endpoint's 'Isolate Device' action to prevent lateral movement.
  2. Disable the user account associated with the activity in Active Directory if it appears to be compromised, and force a password reset through a separate, known-clean system.
  3. Block the source IP or network segment associated with any external DNS zone transfer attempts at the perimeter firewall to prevent further external reconnaissance.
  4. If Lansweeper or a similar network management tool was abused, revoke its service account credentials and rotate the API keys, then re-issue with least-privilege scoped permissions.
  5. Preserve the reconnaissance binary in quarantine — do not delete it. Capture the binary hash and submit for threat intelligence enrichment before quarantine action removes it from the filesystem.

Evidence Collection

  1. Export full process tree for the reconnaissance binary using Get-WinEvent or MDE timeline: capture PID, PPID, command line, user, working directory, and full ancestry back to the session root.
  2. Collect Sysmon Event 1 (process create), Event 3 (network connection), and Event 11 (file create) logs from the affected host for the 2-hour window surrounding the alert.
  3. Export DNS server query logs from Windows DNS (Microsoft-Windows-DNS-Server/Audit) or BIND logs for the period of the alert to identify what DNS queries were made and whether zone transfers were attempted or completed.
  4. Capture network flow data (NetFlow/IPFIX) from the affected subnet to identify all hosts contacted during the scan window — this provides a complete picture of the scope of network mapping performed.
  5. If the recon binary was dropped to disk, collect the file with FTK Imager or a forensic copy tool and compute SHA256, MD5 hashes. Run against VirusTotal and your internal threat intel platform.
  6. Export Windows Security event logs (EventID 4688 if process auditing is enabled, 4624/4648 for logon events) and PowerShell ScriptBlock logs (EventID 4104) for the past 24 hours on the affected host.

Escalation Criteria

  • ! Escalate to incident response if the reconnaissance tool was spawned by a web server, IIS, or application process — this indicates the scan originated from an already-compromised internet-facing system.
  • ! Escalate immediately if nltest /domain_trusts or similar trust enumeration is detected in conjunction with port scanning — this pattern is consistent with APT pre-lateral-movement mapping (matching Volt Typhoon and HAFNIUM TTPs).
  • ! Escalate if a DNS zone transfer (AXFR) was successful and the attacker now has a full list of internal hostnames and IP mappings — this dramatically lowers the cost of subsequent targeting.
  • ! Escalate if the reconnaissance binary was dropped to disk from an external source (identified via DeviceFileEvents InitiatingProcessFileName pointing to a browser, email client, or curl/wget) — this suggests active exploitation rather than insider threat.
  • ! Escalate if multiple hosts in the same subnet show similar reconnaissance activity within a short time window — this indicates the adversary has already achieved broader access and is mapping the environment systematically.

Investigation Guide

Forensic Artifacts

  • > Prefetch files (.pf) in C:\Windows\Prefetch\ for nmap.exe, masscan.exe, lansweeper.exe, dnsrecon.exe — timestamps reveal when tools were first and last executed
  • > Shimcache / AppCompatCache registry entries at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache showing binary execution history even if prefetch is disabled
  • > Amcache.hve (C:\Windows\AppCompat\Programs\Amcache.hve) — records SHA1 hashes of executed binaries, useful for identifying renamed reconnaissance tools
  • > Windows DNS debug log at C:\Windows\System32\dns\dns.log (if enabled) — captures all DNS queries including zone transfer attempts (AXFR/IXFR)
  • > Sysmon operational log (Microsoft-Windows-Sysmon/Operational) — Events 1, 3, 22 provide process, network, and DNS query telemetry
  • > Windows Security log EventID 4688 process creation records (if process command line auditing is enabled via GPO)
  • > Browser download history and email client attachment folders if the recon binary arrived via spearphishing or drive-by download
  • > Network flow records (NetFlow/PCAP) from perimeter or internal switches showing scan pattern traffic (sequential port access across multiple hosts)

Tuning Guidance

Start by building an allowlist of authorized network discovery accounts and service accounts used by IT management platforms (Lansweeper, SolarWinds, Nessus scanner accounts). Add these to exclusion lists in both queries. For the network scan hunt, raise the UniqueDestIPs threshold if your environment has legitimate monitoring agents that poll many hosts. For DNS zone transfer hunting, virtually no false positives should exist for internal DNS — only exclude known secondary nameserver IP addresses that perform legitimate replication. For the built-in command hunt, raise the CommandCount threshold if you have provisioning scripts that run multiple network commands at startup. Consider correlating with your change management system to auto-suppress alerts generated during approved maintenance windows. For Volt Typhoon and HAFNIUM-style activity, prioritize alerts where the reconnaissance tool parent process is cmd.exe or powershell.exe launched from a web server worker process, as this combination has near-zero legitimate use cases.

Hunting Queries

Hunts specifically for DNS zone transfer attempts (AXFR/IXFR) executed via nslookup, dig, or host — these are rarely legitimate and strongly indicate adversary DNS enumeration to map the internal DNS landscape.

Hunting — KQL
kql 
// Hunt for DNS zone transfer attempts via nslookup or dig process command lines
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("nslookup.exe", "dig.exe", "host.exe", "dnsquery.exe")
| where ProcessCommandLine has_any ("axfr", "AXFR", "ixfr", "IXFR", "-t ANY", "type=any", "ls -d", "ls -a")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval CommandLower=lower(CommandLine)
| eval ImageLower=lower(Image)
| where match(ImageLower, "nslookup\.exe|dig\.exe|host\.exe")
| where match(CommandLower, "axfr|ixfr|type=any|-t any|ls -d|ls -a")
| table _time, host, User, Image, CommandLine, ParentImage
| sort -_time

Hunts for network scan patterns by correlating Sysmon network connection events — identifies processes making connections to more than 20 unique internal IPs or 15 unique ports within a 5-minute window, which indicates active host or port scanning even when the tool has been renamed.

Hunting — KQL
kql 
// Hunt for wide-range internal subnet scans using network connection telemetry
DeviceNetworkEvents
| where TimeGenerated > ago(1d)
| where RemoteIPType == "Private"
| where ActionType in ("ConnectionAttempted", "ConnectionFailed", "InboundConnectionAccepted")
| summarize UniqueDestIPs = dcount(RemoteIP), UniqueDestPorts = dcount(RemotePort), TotalAttempts = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(TimeGenerated, 5m)
| where UniqueDestIPs > 20 or UniqueDestPorts > 15
| extend ScanLikelihood = case(
    UniqueDestIPs > 50 and UniqueDestPorts > 10, "High",
    UniqueDestIPs > 20 or UniqueDestPorts > 15, "Medium",
    "Low")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, UniqueDestIPs, UniqueDestPorts, TotalAttempts, ScanLikelihood
| order by UniqueDestIPs desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| where match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)")
| bin _time span=5m
| stats dc(DestinationIp) AS UniqueDestIPs, dc(DestinationPort) AS UniqueDestPorts, count AS TotalConns by _time, host, User, Image
| where UniqueDestIPs > 20 OR UniqueDestPorts > 15
| eval ScanLikelihood=if(UniqueDestIPs > 50 AND UniqueDestPorts > 10, "High", if(UniqueDestIPs > 20 OR UniqueDestPorts > 15, "Medium", "Low"))
| sort -UniqueDestIPs

Hunts for systematic enumeration using built-in Windows networking tools (nltest, arp, nbtstat, netsh, ipconfig) that together reveal domain trusts, network topology, and routing — a pattern consistent with an adversary mapping the environment using living-off-the-land techniques to avoid detection from known tool signatures.

Hunting — KQL
kql 
// Hunt for domain trust and network topology enumeration via built-in Windows commands
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("nltest.exe", "dsquery.exe", "arp.exe", "nbtstat.exe", "net.exe", "netsh.exe", "ipconfig.exe")
| where ProcessCommandLine has_any ("/domain_trusts", "/trusted_domains", "/dclist", "/dsgetdc", "-a", "winsock show", "interface show", "all", "/displaydns")
| where InitiatingProcessFileName !in~ ("services.exe", "svchost.exe", "lsass.exe", "msiexec.exe")
| summarize CommandCount = count(), Commands = make_set(ProcessCommandLine, 20) by DeviceName, AccountName, bin(TimeGenerated, 1h)
| where CommandCount > 3
| order by CommandCount desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval ImageLower=lower(Image)
| eval CommandLower=lower(CommandLine)
| where match(ImageLower, "nltest\.exe|dsquery\.exe|arp\.exe|nbtstat\.exe|net\.exe|netsh\.exe|ipconfig\.exe")
| where match(CommandLower, "domain_trusts|trusted_domains|dclist|dsgetdc|-a |winsock|interface show|displaydns|/all")
| where NOT match(lower(ParentImage), "services\.exe|svchost\.exe|lsass\.exe|msiexec\.exe")
| bin _time span=1h
| stats count AS CommandCount, values(CommandLine) AS Commands by _time, host, User
| where CommandCount > 3
| sort -CommandCount

Atomic Red Team Tests

Test 1 Nmap Internal Subnet Port Scan
windows

Simulates adversary network reconnaissance by running nmap against an internal subnet to identify live hosts and open ports, matching Volt Typhoon and Indrik Spider pre-lateral-movement behavior.

Command

powershell 
nmap -sS -T4 -p 22,80,135,139,443,445,3389,5985,8080 192.168.1.0/24 -oN C:\Temp\nmap_scan_output.txt

Cleanup

powershell 
del C:\Temp\nmap_scan_output.txt

Expected Telemetry

Sysmon EventCode 1 (process create) with Image=nmap.exe, CommandLine containing the subnet range. Sysmon EventCode 3 (network connect) showing connections from nmap.exe to multiple internal IPs on specified ports. DeviceProcessEvents and DeviceNetworkEvents telemetry in MDE.

Expected Detection

Alert fires on the PortHostScanning category with SuspicionScore=90. Network scan hunt query should also fire showing >20 unique destination IPs from nmap.exe within a 5-minute window.

Test 2 DNS Zone Transfer Attempt via nslookup
windows

Attempts a DNS zone transfer (AXFR) against an internal DNS server using nslookup, matching the HAFNIUM pattern of gathering fully-qualified domain names for targeted servers.

Command

powershell 
nslookup -type=AXFR internal.corp.local 192.168.1.10

Cleanup

powershell 
No cleanup required — nslookup does not write files by default

Expected Telemetry

Sysmon EventCode 1 with Image=nslookup.exe, CommandLine containing 'AXFR' and the target domain. Windows DNS debug log (if enabled) will show an AXFR request from the client IP. DeviceProcessEvents in MDE captures the command line.

Expected Detection

DNS zone transfer hunt query fires showing nslookup.exe with AXFR in command line. Main detection also fires under DNSEnumeration category with SuspicionScore=85.

Test 3 Domain Trust Enumeration via nltest
windows

Enumerates Active Directory domain trusts using nltest, replicating the technique used by threat actors to map trusted domains before pivoting to additional environments.

Command

powershell 
nltest /domain_trusts /all_trusts && nltest /dclist:corp.local && nltest /dsgetdc:corp.local /force

Cleanup

powershell 
No cleanup required — nltest is a read-only query tool

Expected Telemetry

Sysmon EventCode 1 (process create) for each nltest invocation with the respective flags in CommandLine. SecurityEvent EventID 4688 if process command line auditing is enabled via GPO. DeviceProcessEvents in MDE with full command line captured.

Expected Detection

Domain trust enumeration hunt query fires when 3+ nltest commands run within a 1-hour window. Main detection fires under DomainTrustEnumeration category with SuspicionScore=70.

Test 4 Internal Network Discovery with Advanced IP Scanner
windows

Downloads and executes Advanced IP Scanner (a tool observed in Indrik Spider operations) to perform internal network discovery, identifying live hosts, open services, and device types.

Command

powershell 
curl -o C:\Temp\advanced_ip_scanner.exe https://download.advanced-ip-scanner.com/download/files/Advanced_IP_Scanner_2.5.4594.1.exe && C:\Temp\advanced_ip_scanner.exe /portable C:\Temp\aiscan

Cleanup

powershell 
Remove-Item -Recurse -Force C:\Temp\advanced_ip_scanner.exe, C:\Temp\aiscan

Expected Telemetry

DeviceFileEvents showing advanced_ip_scanner.exe created in C:\Temp. Sysmon EventCode 11 (file create) for the binary. Process creation event for advanced_ip_scanner.exe. Network connection events to multiple internal IPs during scan. DeviceNetworkEvents in MDE showing mass internal connections.

Expected Detection

Main detection fires under NetworkDiscoveryTool category with SuspicionScore=80. File drop query (if implemented) flags binary created in C:\Temp from curl. Network scan hunt fires showing >20 unique destination IPs within scan window.

Related Detections

Tactic Hub

TA0043Reconnaissance

Sub-techniques (6)

Related Techniques

T1595Active ScanningT1596Search Open Technical DatabasesT1592Gather Victim Host InformationT1591Gather Victim Org InformationT1590.001Domain PropertiesT1590.002DNST1590.005IP AddressesT1590.003Network Trust DependenciesT1590.004Network TopologyT1590.006Network Security AppliancesT1199Trusted RelationshipT1583Acquire Infrastructure

Same Tactic: Reconnaissance

Popular Detections