title: Search Closed Sources (T1597)
id: df00tech-t1597
status: experimental
description: "This detection identifies potential adversary reconnaissance activity involving closed or paid data sources, including commercial threat intelligence vendors, dark web markets, and business intelligence databases. Since T1597 activity primarily occurs outside victim networks, direct detection is limited to second-order indicators: corporate endpoints accessing known data broker or OSINT aggregator platforms (potential insider threat or attacker using compromised access), network egress to dark web proxy services, and external threat intelligence alerting on organizational data appearing in closed criminal marketplaces. Detection confidence is low due to the pre-network nature of this technique, but behavioral patterns such as bulk querying of business intelligence APIs (RocketReach, ZoomInfo, CrunchBase) from non-business-role accounts, or Tor/I2P connectivity from corporate assets, can indicate reconnaissance or insider data harvesting activity."
references:
  - https://attack.mitre.org/techniques/T1597/
  - https://df00tech.com/detections/T1597
author: df00tech
date: 2026/03/19
tags:
  - attack.t1597
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: network_connection
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - "Sales and marketing teams legitimately using ZoomInfo, Apollo.io, or CrunchBase for lead generation and prospecting"
  - "HR and recruiting professionals using Clearbit, RocketReach, or Lusha to source candidates"
  - Security researchers or threat intelligence analysts accessing dark web proxy services as part of authorized threat hunting
  - Automated CI/CD pipelines or marketing automation tools that enrich contact data via data broker APIs
  - "Executives or business development staff conducting due diligence research on acquisition targets via Dun & Bradstreet or Hoovers"
level: medium