Scan Databases
Sub-technique of AML.T0000 Search Open Technical Databases
Description
Adversaries may search public internet-scan services to identify a victim's exposed AI infrastructure. These services, such as Shodan and Censys, continuously scan the internet and publish the active IP addresses, hostnames, open ports, and service banners, which adversaries can query without interacting with the target directly.
Information gathered this way may also reveal candidates for follow-on Active Scanning to confirm that services remain reachable, to probe for misconfigurations or unauthorized endpoints. It may also inform later initial access attempts such as Exploit Public-Facing Application. Unlike Active Scanning, this technique relies on third-party scan data and involves no direct interaction with the victim system.
- ATLAS ID
- AML.T0000.003
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Enterprise
Mitigations
- AML.M0039AI Honeypots
Decoy assets are catalogued by the same internet scan databases (e.g., Shodan, Censys) that adversaries query to locate exposed AI infrastructure. Adversarial engagement that originates from those platforms can grant defenders visibility into those discovery channels.
Case studies that use it
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.