T1597 Search Closed Sources Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let DataBrokerDomains = dynamic([
    "rocketreach.co", "zoominfo.com", "crunchbase.com", "hoovers.com",
    "dun.com", "dnb.com", "spokeo.com", "intelius.com", "pipl.com",
    "beenverified.com", "whitepages.com", "clearbit.com", "hunter.io",
    "fullcontact.com", "datanyze.com", "apollo.io", "lusha.com",
    "seamless.ai", "slintel.com", "demandbase.com"
]);
let TorRelayIndicators = dynamic([
    "torproject.org", "tor2web.org", "onion.to", "onion.link",
    "darkfail.net", "dark.fail"
]);
let ObservedWindow = 24h;
DeviceNetworkEvents
| where Timestamp > ago(ObservedWindow)
| where ActionType in ("ConnectionSuccess", "InboundConnectionAccepted", "HttpConnectionInspected")
| where RemoteUrl has_any (DataBrokerDomains) or RemoteUrl has_any (TorRelayIndicators)
| extend DomainCategory = case(
    RemoteUrl has_any (TorRelayIndicators), "TorOrDarkWebProxy",
    RemoteUrl has_any (DataBrokerDomains), "CommercialDataBroker",
    "Unknown"
  )
| join kind=leftouter (
    DeviceLogonEvents
    | where Timestamp > ago(ObservedWindow)
    | where LogonType in ("Interactive", "RemoteInteractive")
    | summarize LastLogon=max(Timestamp), LogonCount=count() by DeviceName, AccountName
  ) on DeviceName
| project
    Timestamp,
    DeviceName,
    InitiatingProcessAccountName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteUrl,
    RemoteIP,
    RemotePort,
    DomainCategory,
    LocalIPType,
    LocalPort
| summarize
    QueryCount=count(),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    UniqueURLs=dcount(RemoteUrl),
    URLList=make_set(RemoteUrl, 20),
    ProcessList=make_set(InitiatingProcessFileName, 10)
    by DeviceName, InitiatingProcessAccountName, DomainCategory
| where QueryCount > 3 or DomainCategory == "TorOrDarkWebProxy"
| extend RiskScore = case(
    DomainCategory == "TorOrDarkWebProxy", 90,
    QueryCount > 50, 75,
    QueryCount > 20, 60,
    QueryCount > 5, 40,
    25
  )
| sort by RiskScore desc

medium severity low confidence

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceNetworkEvents DeviceLogonEvents

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs
Executives or business development staff conducting due diligence research on acquisition targets via Dun & Bradstreet or Hoovers

Splunk

spl

index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22)
OR (sourcetype="stream:dns")
| eval domain=coalesce(QueryName, query)
| where isnotnull(domain)
| eval DomainCategory=case(
    match(domain, "(?i)(torproject\.org|tor2web\.org|onion\.to|onion\.link|darkfail\.net|dark\.fail)"), "TorOrDarkWebProxy",
    match(domain, "(?i)(rocketreach\.co|zoominfo\.com|crunchbase\.com|hoovers\.com|dnb\.com|spokeo\.com|intelius\.com|pipl\.com|beenverified\.com|clearbit\.com|hunter\.io|fullcontact\.com|datanyze\.com|apollo\.io|lusha\.com|seamless\.ai|demandbase\.com)"), "CommercialDataBroker",
    null()
  )
| where isnotnull(DomainCategory)
| eval host=coalesce(Computer, host)
| eval user=coalesce(User, user)
| stats
    count AS QueryCount,
    min(_time) AS FirstSeen,
    max(_time) AS LastSeen,
    dc(domain) AS UniqueDomains,
    values(domain) AS DomainList
    by host, user, DomainCategory
| where QueryCount > 3 OR DomainCategory="TorOrDarkWebProxy"
| eval RiskScore=case(
    DomainCategory="TorOrDarkWebProxy", 90,
    QueryCount > 50, 75,
    QueryCount > 20, 60,
    QueryCount > 5, 40,
    true(), 25
  )
| eval FirstSeen=strftime(FirstSeen, "%Y-%m-%d %H:%M:%S"),
       LastSeen=strftime(LastSeen, "%Y-%m-%d %H:%M:%S")
| table host, user, DomainCategory, QueryCount, UniqueDomains, DomainList, FirstSeen, LastSeen, RiskScore
| sort - RiskScore

medium severity low confidence

Data Sources

Sysmon Splunk Stream DNS

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational stream:dns

False Positives

Sales operations teams with CRM integrations that auto-enrich leads via ZoomInfo or Apollo.io, generating high DNS query volumes
Security operations teams running authorized dark web monitoring or threat intelligence tooling that queries onion proxies
Marketing automation platforms (HubSpot, Marketo) that call data enrichment APIs in the background during contact sync operations
IT asset management tools that perform reverse lookups against network intelligence services
Developer workstations running open source intelligence (OSINT) tools like theHarvester, Maltego, or Recon-ng for authorized security assessments

Elastic Security (EQL)

eql

// T1597 — Search Closed Sources
any where event.dataset : "network_traffic.http"
  and url.domain : (
    "rocketreach.co", "zoominfo.com", "dnb.com",
    "spokeo.com", "pipl.com", "clearbit.com", "hunter.io",
    "crunchbase.com", "beenverified.com", "intelius.com"
  )

medium severity low confidence

Data Sources

Network Traffic Firewall Logs

Required Tables

logs-network_traffic.* logs-endpoint.events.network-*

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "EventTime",
    LOGSOURCENAME(logsourceid) AS "LogSource",
    LOGSOURCETYPENAME(devicetype) AS "LogSourceType",
    "username", "sourceip", "destinationip",
    "eventid", "deviceaction", "message",
    CASE
        WHEN LOWER("destinationhostname") ILIKE '%rocketreach.co%' OR LOWER("destinationhostname") ILIKE '%zoominfo.com%' OR LOWER("destinationhostname") ILIKE '%clearbit.com%' OR LOWER("destinationhostname") ILIKE '%hunter.io%' THEN 8
        ELSE 4
      END AS "RiskScore"
  FROM events
  WHERE (LOWER("destinationhostname") ILIKE '%rocketreach.co%' OR LOWER("destinationhostname") ILIKE '%zoominfo.com%' OR LOWER("destinationhostname") ILIKE '%clearbit.com%' OR LOWER("destinationhostname") ILIKE '%hunter.io%')
    AND LOGSOURCETYPENAME(devicetype) NOT IN ('SIM Audit', 'Custom Rule Engine')
  ORDER BY "RiskScore" DESC, "EventTime" DESC
  LAST 24 HOURS

medium severity low confidence

Data Sources

QRadar SIEM Windows Security Events Network Firewall Logs Syslog

Required Tables

events

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

Sumo Logic CSE

sql

_sourceCategory=*firewall* OR _sourceCategory=*network*
| json auto
| where !(src_ip matches "10.*") and !(src_ip matches "192.168.*")
| count by src_ip, dest_ip, dest_port
| sort by _count desc

medium severity low confidence

Data Sources

Sumo Logic Cloud SIEM Log Sources via Sumo Logic Collector

Required Tables

network/firewall security/network

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

Google Chronicle / SecOps

yaral

rule t1597_search_closed_sources {
  meta:
    author = "df00tech"
    description = "Detects Search Closed Sources (T1597)"
    mitre_attack_tactic = "TA0043"
    mitre_attack_technique = "T1597"
    confidence = "low"
    severity = "medium"
  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.principal.ip != ""
  condition:
    $e
}

medium severity low confidence

Data Sources

Google Chronicle SIEM Chronicle UDM

Required Tables

NETWORK_CONNECTION NETWORK_FLOW

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

CrowdStrike LogScale (CQL)

cql

#event_simpleName in ["NetworkConnectIP4", "NetworkConnectIP6"]
| not RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| groupBy([RemoteAddressIP4], function=count(as=TotalConns))
| TotalConns > 100
| TechniqueLabel := "T1597 - Reconnaissance"
| table([@timestamp, RemoteAddressIP4, TotalConns, TechniqueLabel])

medium severity low confidence

Data Sources

CrowdStrike Falcon CrowdStrike LogScale

Required Tables

NetworkConnectIP4 ProcessRollup2

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

Search Closed Sources

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (2)

Same Tactic: Reconnaissance

Popular Detections