What MITRE ATT&CK T1597.001: Threat Intel Vendors (Enterprise Tactic TA0043 - Reconnaissance) requires
MITRE ATT&CK T1597.001 (Threat Intel Vendors) is an Enterprise Reconnaissance sub-technique of T1597 (Search Closed Sources). Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures. Affected platforms: PRE. MITRE-documented mitigations include M1056 Pre-compromise.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1597/001/
SHA-256 integrity: 37154f5b0711d3581e079bb4f5718da9371ec7025aee6c523b0fe308a6a9f5fd
Primary Citations — 5 traced to source
- MITRE ATT&CK Technique T1597.001: Threat Intel Vendors (https://attack.mitre.org/techniques/T1597/001/)
- MITRE ATT&CK Tactic TA0043: Reconnaissance (https://attack.mitre.org/tactics/TA0043/)
+ 3 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1597-001-threat-intel-vendors.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1597-001-threat-intel-vendors.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1597-001-threat-intel-vendors
- Back to registry: Browse all 10,085 compliance nodes