value: Adversaries may gather information about the victim's hosts that can be used during targeting. Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, etc.) as well as specifics regarding its configuration (ex: operating system, language, etc.).
  
  Adversaries may gather this information in various ways, such as direct collection actions via [Active Scanning](T1595) or [Phishing for Information](T1598). Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.(Citation: ATT ScanBox) Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](T1593.001) or [Search Victim-Owned Websites](T1594)). Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](T1593) or [Search Open Technical Databases](T1596)), establishing operational resources (ex: [Develop Capabilities](T1587) or [Obtain Capabilities](T1588)), and/or initial access (ex: [Supply Chain Compromise](T1195) or [External Remote Services](T1133)).
name: Gather Victim Host Information