Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

T1597.002 Purchase Technical Data · cyberstrikeus | DecimalAI

cyberstrikeus/T1597.002_purchase-technical-data

SkillScore91Maintained

Adversaries may purchase technical information about victims that can be used during targeting.

Securityby cyberstrikeus

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec packmitre-attackenterpriset1597.002

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cyberstrikeus-t1597-002-purchase-technical-data/SKILL.md

decimalai skills pull cyberstrikeus-t1597-002-purchase-technical-data --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cyberstrikeus-t1597-002-purchase-technical-data/SKILL.md https://app.decimal.ai/s/cyberstrikeus-t1597-002-purchase-technical-data/SKILL.md

Raw file: /s/cyberstrikeus-t1597-002-purchase-technical-data/SKILL.md ↗ · machine-readable summary at /s/cyberstrikeus-t1597-002-purchase-technical-data.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 23d ago

Yes — +13% lift+3% tokens0% turns91% of whole cases pass with skill (21/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	14%	0%
case-12	✗→✓	▲ Improved	-31%	0%
case-16	✗→✓	▲ Improved	39%	0%
case-20	✗→✓	▲ Improved	-51%	0%
case-03	✓→✗	▼ Worse	2%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

cyberstrikeus / cyberstrike

.cyberstrike/skill/mitre_attack/TA0043_reconnaissance/T1597.002_purchase-technical-data/SKILL.md

View on GitHub ↗

License AGPL-3.0Imported 8/10/2026Version v1

Skill contents

SKILL.md

T1597.002 Purchase Technical Data

> Sub-technique of: T1597

High-Level Description

Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.

Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).

Kill Chain Phase

Reconnaissance (TA0043)

Platforms: PRE

What to Check

] Identify if Purchase Technical Data technique is applicable to target environment
] Check PRE systems for indicators of Purchase Technical Data
] Verify mitigations are bypassed or absent (1 known mitigations)
] Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

Identify Attack Surface: Determine if the target environment is susceptible to Purchase Technical Data by examining the target platforms (PRE).

Assess Existing Defenses: Review whether mitigations for T1597.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

> Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1056 Pre-compromise

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

Detection

Detection of Purchase Technical Data

Risk Assessment

| Finding | Severity | Impact | | -------------------------------------------- | -------- | -------------- | | Purchase Technical Data technique applicable | High | Reconnaissance |

CWE Categories

| CWE ID | Title | | ------- | --------------------------------- | | CWE-200 | Exposure of Sensitive Information |

References

Illustrative Want to see what cyberstrikeus/T1597.002_purchase-technical-data would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/31/2026, 09:37 UTC · 23 cases

Lift

+13%

91% vs 78%

Agent turns

0%

1.0 vs 1.0

Tokens

+3%

2,316 vs 2,248.26

fail → pass · 4pass → pass · 17fail → fail · 1pass → fail · 1

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-03 We are reviewing our backend API source code for potential vulnerability patterns. A developer wrote a raw SQL query `SELECT * FROM users WHERE id = '` + req.query.id + `'`. Please analyze this code snippet and provide the appropriate remediation.	pass→fail	23,352	17,895	-23%	1	1	0%	1,879	1,916	+2%	0	0	—
case-01 I need a security assessment report evaluating our exposure to adversaries acquiring third-party aggregated information and breach databases. Please summarize our coverage gaps, severity findings, and potential CWE mappings in a structured summary format.	fail→fail	29,936	26,477	-12%	1	1	0%	3,151	4,279	+36%	0	0	—
case-02 Can you review our threat posture regarding external data acquisition by threat actors and generate an audit checklist? Format the response as an executive briefing outlining how defense teams can minimize sensitive data exposure outside enterprise boundaries.	fail→pass	26,111	23,992	-8%	1	1	0%	3,180	3,617	+14%	0	0	—
case-04 Our SOC analyst detected an anomalous process `svchost.exe` spawning `powershell.exe -enc ...` on a local Windows 11 workstation. Evaluate the host-based memory and process logs to determine the appropriate response steps for host isolation.	pass→pass	32,372	22,434	-31%	1	1	0%	2,933	3,577	+22%	0	0	—
case-05 We are configuring an AWS Security Group rule set for our internal PostgreSQL database server hosted in a VPC. What ingress network port and source IP restrictions should be configured?	pass→pass	17,441	17,844	+2%	1	1	0%	1,897	2,809	+48%	0	0	—
case-06 When categorizing an adversary's purchase of credential leaks and dark web scan database feeds under MITRE ATT&CK T1597.002, our team is debating whether this should be filed under Initial Access (TA0001) or Resource Development (TA0042) since funds are spent. Which MITRE ATT&CK tactic phase should be assigned?	pass→pass	22,428	17,487	-22%	1	1	0%	2,371	2,521	+6%	0	0	—
case-07 Our SIEM engineering team is creating dashboard filters for MITRE ATT&CK techniques by operating system platform. They want to tag T1597.002 under Windows, Linux, and macOS logs. What platform tag should actually be assigned to T1597.002 in MITRE ATT&CK?	pass→pass	14,809	10,744	-27%	1	1	0%	1,130	1,599	+42%	0	0	—
case-13 In an incident report, an analyst states that adversaries purchasing technical data can only obtain generic DNS records. What specific types of technical details can threat actors gather from purchased aggregators and breach databases under T1597.002?	pass→pass	15,624	19,755	+26%	1	1	0%	2,455	2,804	+14%	0	0	—
case-08 A red team operator wants to execute automated test scripts for T1597.002 using the standard open-source Atomic Red Team repository before an upcoming audit. What is the current status of Atomic Red Team execution scripts for this sub-technique?	pass→pass	18,722	9,802	-48%	1	1	0%	1,860	1,291	-31%	0	0	—
case-09 During a threat modeling exercise using MITRE ATT&CK, an analyst needs to document the parent technique code for sub-technique T1597.002 (Purchase Technical Data). Should this be filed under T1589 (Gather Victim Identity Information) or T1597?	pass→pass	11,706	11,241	-4%	1	1	0%	833	1,618	+94%	0	0	—
case-10 A security manager proposes installing host-based intrusion prevention agents and strict egress firewall rules to block adversaries from buying company domain intelligence on external dark web markets. Explain why traditional preventive network controls are ineffective for M1056 and state what the actual mitigation strategy focus must be.	pass→pass	20,769	14,047	-32%	1	1	0%	2,373	2,158	-9%	0	0	—
case-11 An auditor claims that purchasing corporate technical details from third-party aggregators should be mapped to CWE-16 (Configuration) and CWE-287 (Improper Authentication). What single official CWE entry is assigned to cover the exposure of technical data under T1597.002?	pass→pass	13,343	3,032	-77%	1	1	0%	2,431	1,233	-49%	0	0	—
case-12 We are building an automated risk rating matrix for threat reconnaissance techniques. When an assessment confirms that an organization's technical data is vulnerable to being purchased by threat actors, what severity level and impact category should be assigned in the formal risk finding?	fail→pass	16,874	6,999	-59%	1	1	0%	2,533	1,744	-31%	0	0	—
case-14 When adversaries acquire technical data from paid scan feeds or cybercrime markets during reconnaissance, what downstream MITRE ATT&CK initial access tactics are directly facilitated?	pass→pass	18,944	16,288	-14%	1	1	0%	3,297	2,534	-23%	0	0	—
case-15 An engineering lead insists that internal host EDR logs and network IDS rules will reliably generate alert telemetry whenever an attacker purchases technical data about the enterprise. How should the security team evaluate detection capabilities for T1597.002?	pass→pass	18,120	15,265	-16%	1	1	0%	2,739	3,186	+16%	0	0	—
case-16 A threat analyst is categorizing an incident where an adversary ran an active Nmap network scan against the organization's public IP range versus an incident where an adversary bought a Shodan subscription feed containing the company's open port history. How does MITRE ATT&CK classify the purchase of external scan database feeds versus active scanning?	fail→pass	15,727	16,116	+2%	1	1	0%	1,975	2,750	+39%	0	0	—
case-17 In a threat intelligence briefing on technical data acquisition, what distinct categories of sources (ranging from reputable commercial providers to illicit venues) do adversaries utilize to obtain victim details?	pass→pass	23,904	19,198	-20%	1	1	0%	2,762	2,978	+8%	0	0	—
case-18 When performing a structured MITRE ATT&CK assessment check for T1597.002 across enterprise systems, what is the initial verification step required to determine context?	pass→pass	12,054	14,140	+17%	1	1	0%	1,939	1,865	-4%	0	0	—
case-19 During a reconnaissance audit of pre-compromise infrastructure, which systems group must be checked for indicators related to Purchase Technical Data under ATT&CK standard procedures?	pass→pass	16,030	2,873	-82%	1	1	0%	2,679	1,142	-57%	0	0	—
case-20 During a SOC audit review of technique coverage metrics for T1597.002, how many known MITRE ATT&CK mitigations and how many detection strategies exist for this sub-technique?	fail→pass	22,617	7,868	-65%	1	1	0%	2,247	1,110	-51%	0	0	—
case-21 An enterprise wants to minimize its exposure to technical data acquisition without altering its internal firewall policies. What administrative operational practices fulfill the pre-compromise remediation guidance for external technical data exposure?	pass→pass	20,549	20,092	-2%	1	1	0%	2,368	3,008	+27%	0	0	—
case-22 An analyst is logging an adversary who paid $500 on an underground marketplace for a leaked internal network architecture diagram. The analyst considers tagging this under T1593 (Search Open Websites/Domains). Why is T1597.002 the precise classification instead?	pass→pass	13,568	14,528	+7%	1	1	0%	1,440	2,276	+58%	0	0	—
case-23 In addition to Initial Access and further Reconnaissance, what operational capability building phase in MITRE ATT&CK can adversaries advance by purchasing technical data under T1597.002?	pass→pass	11,879	8,638	-27%	1	1	0%	1,238	1,253	+1%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 23 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 78.3%
Pass rate with the skill: 91.3%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 1
Skill version measured: v1
Run completed: 8/31/2026, 09:37 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

Can you review our threat posture regarding external data acquisition by threat actors and generate an audit checklist? Format the response as an executive briefing outlining how defense teams can minimize sensitive data exposure outside enterprise boundaries.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run91

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+3% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 22 days ago

Other measured skills in the registry, with their headline benchmark lift.