Gather Victim Host Information (4acf57da-73c1-4555-a86a-38ea4a8b962d)

Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).

Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information. Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.^{[ATT ScanBox]} Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).

Adversaries may also gather victim host information via User-Agent HTTP headers, which are sent to a server to identify the application, operating system, vendor, and/or version of the requesting user agent. This can be used to inform the adversary’s follow-on action. For example, adversaries may check user agents for the requesting operating system, then only serve malware for target operating systems while ignoring others.^{[TrellixQakbot]}

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Gather Victim Host Information (4acf57da-73c1-4555-a86a-38ea4a8b962d)	Tidal Technique	1
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (56ab198f-f8bb-4fe9-bd85-5975d4d3863b)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (5c3c8da1-ed0c-4b79-9794-c2fc55588ad9)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Search Closed Sources (40e4133b-28c2-4da7-9a6a-7392ae87f1da)	Tidal Technique	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (cb4ec901-fe61-4b44-8ad7-7d3d9a9bc809)	Unknown	2
Search Open Technical Databases (cf79ad1b-a82b-486b-88ad-e93bfc1c7439)	Tidal Technique	Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (ef55dc56-f2eb-4a3b-a271-3f73b4700c89)	Unknown	2
Search Open Websites/Domains (f2d216e3-43d6-4a2e-aa5b-d6be78d018b6)	Tidal Technique	Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (758ad44d-5e29-4c7f-8dae-ddfeb5092ccb)	Unknown	2
Search Victim-Owned Websites (c55c0462-d59f-4bd8-9728-05cf711917b0)	Tidal Technique	Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (1f28a8a5-7231-47ad-9943-73b3cc6d05b0)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (a5ab5108-1582-4357-b948-1c6148c7b5ce)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (4a68c72c-79c1-4fed-9107-75bb5b06dfc3)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (afe743a7-56b0-4ad1-bd36-dd50d64802fc)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (454be621-ea64-409c-981f-809f1238e21c)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (a150a804-1a17-45aa-a49f-d65ee901ab59)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (c0a8e0d6-c108-4c15-9a3a-78ef1da06e32)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (2eee984c-ea00-4284-b3eb-fd0c603a5a80)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (c60e4f32-d8f0-49e8-b0f7-57a6ae35b8bb)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (62bc11f9-f88c-437a-98ae-e90def576e7e)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (9bd53629-fa2c-417d-b937-c575504be5b1)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (2e4201da-fe83-439d-9d40-87e4c1f832fb)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (72668851-bf65-42eb-a775-bc607f4520a2)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (bc4f11b1-fd06-4e49-be48-e73ece82f1a9)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (b18ddaf9-2939-45db-8b2a-2edecc2097ac)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (d8dcce33-3a7e-4a1c-95c6-afdcf2fa1df6)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (8f707326-d673-43ee-b269-4b6eca5b190a)	Unknown	2
Gather Victim Identity Information (aea36489-047e-4c4a-ab26-c51fd3556182)	Tidal Technique	Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	2
Active Scanning (a930437d-5a12-4dc4-b311-f5fd6a766c85)	Tidal Technique	Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	2
Gather Victim Network Information (58776ca9-0c54-487f-afcc-e7e5b661bd54)	Tidal Technique	Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (8af6a9ee-c323-44fa-85d3-29366fd1bb4f)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (77476b73-f4d1-4689-8f9e-af08d27f4cba)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Gather Victim Org Information (e55d2e4b-07d8-4c22-b543-c187be320578)	Tidal Technique	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (d97c3d34-1210-4c71-b305-59dcccab8f45)	Unknown	2
Phishing for Information (b6fe2fda-9c05-4f05-b049-7bb5b9ba5b06)	Tidal Technique	Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (e5d9c785-61bd-483f-b2ac-5bd9a8641b22)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (a0e40412-cbfb-477b-87fc-40f2c84d26be)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (63a99eb9-0da7-4286-bfc9-c306a03abf24)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (473afdb8-5048-4838-a3fc-56be30be1e56)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (ec145032-4b1b-4dbe-85bf-47360e35b0a3)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (b39cc340-ee1d-46a8-add2-f36aade56f15)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (d93b51df-014a-4d46-949a-4b8f796e6cca)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (7f953df5-c91f-4975-a579-2be3c89bca7e)	Unknown	2
Reconnaissance (2706dc98-724b-4cf0-84b6-56cc20b0698e)	Tidal Tactic	Private Cluster (113b8750-d166-5cac-bd26-2c82c90b9d88)	Unknown	2