title: Search Threat Vendor Data (T1681)
id: df00tech-t1681
status: experimental
description: "Detects adversary reconnaissance activity where threat actors query threat intelligence vendor services — such as VirusTotal, Shodan, Recorded Future, AlienVault OTX, or GreyNoise — to monitor whether their own infrastructure, malware samples, or campaign indicators have been detected and published. Since this technique primarily occurs outside the victim network, detections are indirect and focus on observable side effects: suspicious outbound connections to threat intel APIs from hosts with no legitimate business reason, correlation of known malicious IP indicators making threat intel queries visible through egress proxy logs, and rapid indicator rotation patterns following public threat intel disclosures. Adversaries have been documented replacing flagged indicators within days of publication, making behavioral correlation between threat intel release timestamps and infrastructure changes a secondary hunting signal."
references:
  - https://attack.mitre.org/techniques/T1681/
  - https://df00tech.com/detections/T1681
author: df00tech
date: 2026/03/20
tags:
  - attack.t1681
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: network_connection
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - Security Operations Center analysts performing daily threat hunting or indicator enrichment via threat intel APIs
  - Automated SOAR playbooks or SIEM enrichment workflows querying VirusTotal or similar platforms to enrich alerts
  - Vulnerability management or penetration testing tools performing infrastructure fingerprinting via Shodan
  - Security researchers and threat intelligence teams conducting legitimate campaign analysis
  - Endpoint protection platforms that perform cloud-based file reputation lookups through proxy-visible connections
level: medium