Detect Search Open Technical Databases in CrowdStrike LogScale
This detection identifies potential adversary reconnaissance activity involving queries to open technical databases such as Shodan, Censys, Certificate Transparency logs, passive DNS repositories, WHOIS services, and CDN enumeration tools. Because T1596 is a PRE-ATT&CK technique executed outside the victim network, direct detection is not possible. Instead, this rule focuses on second-order indicators: internal endpoints or service accounts making scripted bulk queries to known OSINT aggregator domains, automated certificate transparency monitoring tools being abused, and unusual DNS resolution patterns targeting passive DNS APIs. Detection of these behaviors may indicate an insider threat, a compromised endpoint conducting pre-pivot reconnaissance, or red team activity. Confidence is set to low due to high false positive potential from legitimate security research and threat intelligence workflows.
MITRE ATT&CK
- Tactic
- Reconnaissance
- Technique
- T1596 Search Open Technical Databases
- Canonical reference
- https://attack.mitre.org/techniques/T1596/
LogScale Detection Query
#event_simpleName in ["NetworkConnectIP4", "NetworkConnectIP6"]
| not RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| groupBy([RemoteAddressIP4], function=count(as=TotalConns))
| TotalConns > 100
| TechniqueLabel := "T1596 - Reconnaissance"
| table([@timestamp, RemoteAddressIP4, TotalConns, TechniqueLabel])CrowdStrike LogScale (Falcon) CQL detection for Search Open Technical Databases (T1596). Uses CrowdStrike event simpleName taxonomy with regex-based field filtering, groupBy aggregation, and case-based risk classification. Designed for the Falcon platform's LogScale query language.
Data Sources
Required Tables
False Positives & Tuning
- Security analysts and threat intelligence teams performing legitimate asset discovery or exposure monitoring using these same OSINT tools
- Red team or penetration testing engagements querying Shodan/Censys to validate external attack surface
- Automated vulnerability management platforms (e.g., Tenable.io, Rapid7) that query third-party databases as part of external exposure scanning
- DevSecOps pipelines using crt.sh or SecurityTrails APIs for certificate transparency monitoring in CI/CD
Other platforms for T1596
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Shodan CLI Reconnaissance of Organization IP Range
Expected signal: Sysmon EventCode 3 (Network Connection) to api.shodan.io:443 from python process; Sysmon EventCode 22 (DNS Query) for api.shodan.io; DeviceNetworkEvents showing ConnectionSuccess to shodan.io from python.exe or python3.exe
- Test 2Certificate Transparency Bulk Query via crt.sh API
Expected signal: Sysmon EventCode 1 (Process Create) for powershell.exe with Invoke-RestMethod in CommandLine; Sysmon EventCode 3 (Network Connection) to crt.sh:443; Windows Security EventCode 4688 (Process Creation) if Sysmon not available; DeviceNetworkEvents showing connection to crt.sh from powershell.exe
- Test 3Multi-Source OSINT Enumeration Script
Expected signal: Sysmon EventCode 3 (Network Connection) entries for hackertarget.com and viewdns.info from bash/curl; Sysmon EventCode 22 (DNS Query) for api.hackertarget.com, api.viewdns.info; proxy logs showing sequential requests to multiple OSINT domains within short time window
References (11)
- https://attack.mitre.org/techniques/T1596/
- https://attack.mitre.org/techniques/T1596/001/
- https://attack.mitre.org/techniques/T1596/002/
- https://attack.mitre.org/techniques/T1596/003/
- https://attack.mitre.org/techniques/T1596/004/
- https://attack.mitre.org/techniques/T1596/005/
- https://www.shodan.io/
- https://search.censys.io/
- https://crt.sh/
- https://securitytrails.com/
- https://dnsdumpster.com/
Unlock Pro Content
Get the full detection package for T1596 including response playbook, investigation guide, and atomic red team tests.