{'created': '2020-10-02T15:46:24.670Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': "Adversaries may gather information about the victim's network "
                'domain(s) that can be used during targeting. Information '
                'about domains and their properties may include a variety of '
                'details, including what domain(s) the victim owns as well as '
                'administrative data (ex: name, registrar, etc.) and more '
                'directly actionable information such as contacts (email '
                'addresses and phone numbers), business addresses, and name '
                'servers.\n'
                '\n'
                'Adversaries may gather this information in various ways, such '
                'as direct collection actions via [Active '
                'Scanning](https://attack.mitre.org/techniques/T1595) or '
                '[Phishing for '
                'Information](https://attack.mitre.org/techniques/T1598). '
                'Information about victim domains and their properties may '
                'also be exposed to adversaries via online or other accessible '
                'data sets (ex: '
                '[WHOIS](https://attack.mitre.org/techniques/T1596/002)).(Citation: '
                'WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS) '
                'Where third-party cloud providers are in use, this '
                'information may also be exposed through publicly available '
                'API endpoints, such as GetUserRealm and autodiscover in '
                'Office 365 environments.(Citation: Azure Active Directory '
                'Reconnaisance)(Citation: Office 265 Azure Domain '
                'Availability) Gathering this information may reveal '
                'opportunities for other forms of reconnaissance (ex: [Search '
                'Open Technical '
                'Databases](https://attack.mitre.org/techniques/T1596), '
                '[Search Open '
                'Websites/Domains](https://attack.mitre.org/techniques/T1593), '
                'or [Phishing for '
                'Information](https://attack.mitre.org/techniques/T1598)), '
                'establishing operational resources (ex: [Acquire '
                'Infrastructure](https://attack.mitre.org/techniques/T1583) or '
                '[Compromise '
                'Infrastructure](https://attack.mitre.org/techniques/T1584)), '
                'and/or initial access (ex: '
                '[Phishing](https://attack.mitre.org/techniques/T1566)).',
 'external_references': [{'external_id': 'T1590.001',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1590/001'},
                         {'description': 'CIRCL Computer Incident Response '
                                         'Center. (n.d.). Passive DNS. '
                                         'Retrieved October 20, 2020.',
                          'source_name': 'Circl Passive DNS',
                          'url': 'https://www.circl.lu/services/passive-dns/'},
                         {'description': 'Dr. Nestori Syynimaa. (2020, June '
                                         '13). Just looking: Azure Active '
                                         'Directory reconnaissance as an '
                                         'outsider. Retrieved May 27, 2022.',
                          'source_name': 'Azure Active Directory Reconnaisance',
                          'url': 'https://o365blog.com/post/just-looking/'},
                         {'description': 'Hacker Target. (n.d.). DNS Dumpster. '
                                         'Retrieved October 20, 2020.',
                          'source_name': 'DNS Dumpster',
                          'url': 'https://dnsdumpster.com/'},
                         {'description': 'Microsoft. (2017, January 23). '
                                         '(Cloud) Tip of the Day: Advanced way '
                                         'to check domain availability for '
                                         'Office 365 and Azure. Retrieved May '
                                         '27, 2022.',
                          'source_name': 'Office 265 Azure Domain Availability',
                          'url': 'https://docs.microsoft.com/en-us/archive/blogs/tip_of_the_day/cloud-tip-of-the-day-advanced-way-to-check-domain-availability-for-office-365-and-azure'},
                         {'description': 'NTT America. (n.d.). Whois Lookup. '
                                         'Retrieved November 17, 2024.',
                          'source_name': 'WHOIS',
                          'url': 'https://who.is/'}],
 'id': 'attack-pattern--e3b168bd-fcd7-439e-9382-2e6c2f63514d',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'reconnaissance'}],
 'modified': '2025-10-24T17:49:31.581Z',
 'name': 'Domain Properties',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Jannie Li, Microsoft Threat Intelligence\u202f'
                          'Center\u202f(MSTIC)'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['PRE'],
 'x_mitre_version': '1.1'}