Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.

Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
DNS/Passive DNS
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1596/001  external_id: T1596.001     source_name: DNS Dumpster  description: Hacker Target. (n.d.). DNS Dumpster. Retrieved October 20, 2020.  url: https://dnsdumpster.com/     source_name: Circl Passive DNS  description: CIRCL Computer Incident Response Center. (n.d.). Passive DNS. Retrieved October 20, 2020.  url: https://www.circl.lu/services/passive-dns/     