{'created': '2020-10-02T17:01:42.558Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may search and gather information about victims '
                'from closed (e.g., paid, private, or otherwise not freely '
                'available) sources that can be used during targeting. '
                'Information about victims may be available for purchase from '
                'reputable private sources and databases, such as paid '
                'subscriptions to feeds of technical/threat intelligence data. '
                'Adversaries may also purchase information from less-reputable '
                'sources such as dark web or cybercrime '
                'blackmarkets.(Citation: ZDNET Selling Data)\n'
                '\n'
                'Adversaries may search in different closed databases '
                'depending on what information they seek to gather. '
                'Information from these sources may reveal opportunities for '
                'other forms of reconnaissance (ex: [Phishing for '
                'Information](https://attack.mitre.org/techniques/T1598) or '
                '[Search Open '
                'Websites/Domains](https://attack.mitre.org/techniques/T1593)), '
                'establishing operational resources (ex: [Develop '
                'Capabilities](https://attack.mitre.org/techniques/T1587) or '
                '[Obtain '
                'Capabilities](https://attack.mitre.org/techniques/T1588)), '
                'and/or initial access (ex: [External Remote '
                'Services](https://attack.mitre.org/techniques/T1133) or '
                '[Valid Accounts](https://attack.mitre.org/techniques/T1078)).',
 'external_references': [{'external_id': 'T1597',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1597'},
                         {'description': 'Cimpanu, C. (2020, May 9). A hacker '
                                         'group is selling more than 73 '
                                         'million user records on the dark '
                                         'web. Retrieved October 20, 2020.',
                          'source_name': 'ZDNET Selling Data',
                          'url': 'https://www.zdnet.com/article/a-hacker-group-is-selling-more-than-73-million-user-records-on-the-dark-web/'}],
 'id': 'attack-pattern--a51eb150-93b1-484b-a503-e51453b127a4',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'reconnaissance'}],
 'modified': '2025-10-24T17:49:11.164Z',
 'name': 'Search Closed Sources',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.3.0',
 'x_mitre_contributors': ['Barbara Louis-Sidney (OWN-CERT)'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': False,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['PRE'],
 'x_mitre_version': '1.1'}