Which SIEM platforms have a T1597 detection rule?

df00tech provides T1597 (Search Closed Sources) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Search Closed Sources (T1597)?

Detecting Search Closed Sources requires the following data sources: Microsoft Defender for Endpoint.

What severity and confidence is the T1597 detection?

The T1597 detection is rated medium severity with low confidence.

What are common false positives for T1597?

Common false positives for T1597 include: Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting; HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates; Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting.

T1597: Search Closed Sources — Detection (KQL, SPL, Sigma + 5 SIEMs)

Microsoft Sentinel / Defender

kusto

let DataBrokerDomains = dynamic([
    "rocketreach.co", "zoominfo.com", "crunchbase.com", "hoovers.com",
    "dun.com", "dnb.com", "spokeo.com", "intelius.com", "pipl.com",
    "beenverified.com", "whitepages.com", "clearbit.com", "hunter.io",
    "fullcontact.com", "datanyze.com", "apollo.io", "lusha.com",
    "seamless.ai", "slintel.com", "demandbase.com"
]);
let TorRelayIndicators = dynamic([
    "torproject.org", "tor2web.org", "onion.to", "onion.link",
    "darkfail.net", "dark.fail"
]);
let ObservedWindow = 24h;
DeviceNetworkEvents
| where Timestamp > ago(ObservedWindow)
| where ActionType in ("ConnectionSuccess", "InboundConnectionAccepted", "HttpConnectionInspected")
| where RemoteUrl has_any (DataBrokerDomains) or RemoteUrl has_any (TorRelayIndicators)
| extend DomainCategory = case(
    RemoteUrl has_any (TorRelayIndicators), "TorOrDarkWebProxy",
    RemoteUrl has_any (DataBrokerDomains), "CommercialDataBroker",
    "Unknown"
  )
| join kind=leftouter (
    DeviceLogonEvents
    | where Timestamp > ago(ObservedWindow)
    | where LogonType in ("Interactive", "RemoteInteractive")
    | summarize LastLogon=max(Timestamp), LogonCount=count() by DeviceName, AccountName
  ) on DeviceName
| project
    Timestamp,
    DeviceName,
    InitiatingProcessAccountName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteUrl,
    RemoteIP,
    RemotePort,
    DomainCategory,
    LocalIPType,
    LocalPort
| summarize
    QueryCount=count(),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    UniqueURLs=dcount(RemoteUrl),
    URLList=make_set(RemoteUrl, 20),
    ProcessList=make_set(InitiatingProcessFileName, 10)
    by DeviceName, InitiatingProcessAccountName, DomainCategory
| where QueryCount > 3 or DomainCategory == "TorOrDarkWebProxy"
| extend RiskScore = case(
    DomainCategory == "TorOrDarkWebProxy", 90,
    QueryCount > 50, 75,
    QueryCount > 20, 60,
    QueryCount > 5, 40,
    25
  )
| sort by RiskScore desc

Detects corporate endpoints making network connections to known commercial data broker platforms (RocketReach, ZoomInfo, CrunchBase, Apollo.io, etc.) and Tor/dark web proxy services. High-volume querying of data broker APIs from non-standard processes, or any Tor proxy connectivity, may indicate insider threat activity or a compromised endpoint being used to conduct reconnaissance against the organization or third parties. Aggregates connection counts per device/account to surface bulk querying patterns.

medium severity low confidence

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceNetworkEvents DeviceLogonEvents

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs
Executives or business development staff conducting due diligence research on acquisition targets via Dun & Bradstreet or Hoovers

Splunk

spl

index=* (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22)
OR (sourcetype="stream:dns")
| eval domain=coalesce(QueryName, query)
| where isnotnull(domain)
| eval DomainCategory=case(
    match(domain, "(?i)(torproject\.org|tor2web\.org|onion\.to|onion\.link|darkfail\.net|dark\.fail)"), "TorOrDarkWebProxy",
    match(domain, "(?i)(rocketreach\.co|zoominfo\.com|crunchbase\.com|hoovers\.com|dnb\.com|spokeo\.com|intelius\.com|pipl\.com|beenverified\.com|clearbit\.com|hunter\.io|fullcontact\.com|datanyze\.com|apollo\.io|lusha\.com|seamless\.ai|demandbase\.com)"), "CommercialDataBroker",
    null()
  )
| where isnotnull(DomainCategory)
| eval host=coalesce(Computer, host)
| eval user=coalesce(User, user)
| stats
    count AS QueryCount,
    min(_time) AS FirstSeen,
    max(_time) AS LastSeen,
    dc(domain) AS UniqueDomains,
    values(domain) AS DomainList
    by host, user, DomainCategory
| where QueryCount > 3 OR DomainCategory="TorOrDarkWebProxy"
| eval RiskScore=case(
    DomainCategory="TorOrDarkWebProxy", 90,
    QueryCount > 50, 75,
    QueryCount > 20, 60,
    QueryCount > 5, 40,
    true(), 25
  )
| eval FirstSeen=strftime(FirstSeen, "%Y-%m-%d %H:%M:%S"),
       LastSeen=strftime(LastSeen, "%Y-%m-%d %H:%M:%S")
| table host, user, DomainCategory, QueryCount, UniqueDomains, DomainList, FirstSeen, LastSeen, RiskScore
| sort - RiskScore

Detects DNS queries (via Sysmon Event ID 22 or stream:dns) to known commercial data broker domains and Tor/dark web proxy services. Aggregates query volume per host and user to surface bulk OSINT reconnaissance patterns. Any Tor proxy DNS resolution from a corporate endpoint is flagged at high risk regardless of frequency.

medium severity low confidence

Data Sources

Sysmon Splunk Stream DNS

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational stream:dns

False Positives

Sales operations teams with CRM integrations that auto-enrich leads via ZoomInfo or Apollo.io, generating high DNS query volumes
Security operations teams running authorized dark web monitoring or threat intelligence tooling that queries onion proxies
Marketing automation platforms (HubSpot, Marketo) that call data enrichment APIs in the background during contact sync operations
IT asset management tools that perform reverse lookups against network intelligence services
Developer workstations running open source intelligence (OSINT) tools like theHarvester, Maltego, or Recon-ng for authorized security assessments

Elastic Security (EQL)

eql

// T1597 — Search Closed Sources
any where event.dataset : "network_traffic.http"
  and url.domain : (
    "rocketreach.co", "zoominfo.com", "dnb.com",
    "spokeo.com", "pipl.com", "clearbit.com", "hunter.io",
    "crunchbase.com", "beenverified.com", "intelius.com"
  )

Elastic EQL detection for Search Closed Sources (T1597). Translates the Microsoft Sentinel KQL logic to Elastic Common Schema (ECS) field mappings for use in Elastic SIEM. Targets the same behavioral indicators across process creation, network, and authentication event types.

medium severity low confidence

Data Sources

Network Traffic Firewall Logs

Required Tables

logs-network_traffic.* logs-endpoint.events.network-*

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS "EventTime",
    LOGSOURCENAME(logsourceid) AS "LogSource",
    LOGSOURCETYPENAME(devicetype) AS "LogSourceType",
    "username", "sourceip", "destinationip",
    "eventid", "deviceaction", "message",
    CASE
        WHEN LOWER("destinationhostname") ILIKE '%rocketreach.co%' OR LOWER("destinationhostname") ILIKE '%zoominfo.com%' OR LOWER("destinationhostname") ILIKE '%clearbit.com%' OR LOWER("destinationhostname") ILIKE '%hunter.io%' THEN 8
        ELSE 4
      END AS "RiskScore"
  FROM events
  WHERE (LOWER("destinationhostname") ILIKE '%rocketreach.co%' OR LOWER("destinationhostname") ILIKE '%zoominfo.com%' OR LOWER("destinationhostname") ILIKE '%clearbit.com%' OR LOWER("destinationhostname") ILIKE '%hunter.io%')
    AND LOGSOURCETYPENAME(devicetype) NOT IN ('SIM Audit', 'Custom Rule Engine')
  ORDER BY "RiskScore" DESC, "EventTime" DESC
  LAST 24 HOURS

QRadar AQL detection for Search Closed Sources (T1597). SQL-like syntax queries the QRadar events store, correlating log source telemetry with risk scoring to surface reconnaissance and attack patterns. Filters out noise from internal SIM and rule engine log sources.

medium severity low confidence

Data Sources

QRadar SIEM Windows Security Events Network Firewall Logs Syslog

Required Tables

events

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

Sumo Logic CSE

sql

_sourceCategory=*firewall* OR _sourceCategory=*network*
| json auto
| where !(src_ip matches "10.*") and !(src_ip matches "192.168.*")
| count by src_ip, dest_ip, dest_port
| sort by _count desc

Sumo Logic detection for Search Closed Sources (T1597). Uses _sourceCategory path filtering for flexible log routing compatibility, with JSON field extraction and statistical aggregation to surface search closed sources patterns. Designed for the Sumo Logic Cloud SIEM platform.

medium severity low confidence

Data Sources

Sumo Logic Cloud SIEM Log Sources via Sumo Logic Collector

Required Tables

network/firewall security/network

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

Google Chronicle / SecOps

yaral

rule t1597_search_closed_sources {
  meta:
    author = "df00tech"
    description = "Detects Search Closed Sources (T1597)"
    mitre_attack_tactic = "TA0043"
    mitre_attack_technique = "T1597"
    confidence = "low"
    severity = "medium"
  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    $e.principal.ip != ""
  condition:
    $e
}

Google Chronicle YARA-L 2.0 detection rule for Search Closed Sources (T1597). Uses Unified Data Model (UDM) event field mappings to detect the same behavioral patterns as the KQL rule, with Chronicle's temporal matching and entity correlation capabilities.

medium severity low confidence

Data Sources

Google Chronicle SIEM Chronicle UDM

Required Tables

NETWORK_CONNECTION NETWORK_FLOW

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

CrowdStrike LogScale (CQL)

cql

#event_simpleName in ["NetworkConnectIP4", "NetworkConnectIP6"]
| not RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)/
| groupBy([RemoteAddressIP4], function=count(as=TotalConns))
| TotalConns > 100
| TechniqueLabel := "T1597 - Reconnaissance"
| table([@timestamp, RemoteAddressIP4, TotalConns, TechniqueLabel])

CrowdStrike LogScale (Falcon) CQL detection for Search Closed Sources (T1597). Uses CrowdStrike event simpleName taxonomy with regex-based field filtering, groupBy aggregation, and case-based risk classification. Designed for the Falcon platform's LogScale query language.

medium severity low confidence

Data Sources

CrowdStrike Falcon CrowdStrike LogScale

Required Tables

NetworkConnectIP4 ProcessRollup2

False Positives

Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting
HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates
Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs

Search Closed Sources

What is T1597 Search Closed Sources?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1597

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Tactic Hub

Sub-techniques (2)

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

What is T1597 Search Closed Sources?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for T1597

Testing Methodology

Unlock Pro Content

Related Detections

Tactic Hub

Sub-techniques (2)

Related Techniques

Same Tactic: Reconnaissance

Popular Detections

Get new detections in your inbox