AN1998: Analytic 1998
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.
Analyst context for executives and security teams
AN1998 is a MITRE ATT&CK detection analytic for pre-compromise activity where the official note emphasizes a practical challenge: the behavior may happen frequently, generate many false positives, and occur outside the target organization’s visibility. For leaders, the value is less about a simple alert rule and more about deciding whether the organization has enough external-facing intelligence, logging, and triage capacity to separate meaningful signals from background noise.
Executive priority
Treat this as a coverage and expectations issue for early-warning detection. Because the ATT&CK object lists the platform as PRE and provides no specific tactic or detection logic, executives should ask whether pre-compromise monitoring is in scope for the SOC or managed detection provider, what evidence is available outside internal telemetry, and how false-positive handling is governed. This matters for incident readiness, threat intelligence requirements, and audit defensibility: teams should be able to explain what they can and cannot see before an intrusion occurs.
Technical view
SOC, threat intelligence, and detection engineering teams should validate whether this analytic is intended to monitor pre-compromise indicators and whether the required evidence is actually observable by the organization. The official description warns that activity may be common, noisy, and outside direct visibility, so detection should be framed around enrichment, prioritization, and correlation rather than a standalone high-confidence alert. No ATT&CK tactic, technique relationship, or official detection procedure was supplied, so local implementation must define the observable conditions, confidence thresholds, and escalation criteria.
Likely telemetry
- External threat intelligence or exposure-monitoring data relevant to pre-compromise activity
- Public-facing asset inventory and ownership context
- Third-party or managed detection reporting, if used for PRE visibility
- Case management records showing enrichment, deduplication, and false-positive disposition
- Contextual business data for prioritizing externally observed activity against critical assets
Detection direction
- Confirm whether the organization has visibility into the relevant PRE activity, since the official ATT&CK text notes it may occur outside the target organization’s visibility.
- Avoid treating high-volume observations as automatically actionable; require enrichment against known assets, business criticality, and repeatability.
- Measure false-positive rates and analyst workload before promoting this analytic to production alerting.
- Define escalation criteria for when noisy pre-compromise signals become incident-response-relevant.
- Document visibility gaps explicitly, especially where evidence depends on external sources or third-party monitoring.
Mitigation priorities
- Start with scope: decide whether PRE monitoring is owned by the SOC, threat intelligence, external attack surface management, a managed provider, or a combination.
- Maintain an accurate inventory of public-facing assets so externally observed signals can be mapped to business owners and critical systems.
- Use risk-based triage to prioritize signals tied to important assets or repeated patterns rather than isolated noisy events.
- Create playbooks for enrichment, suppression, escalation, and evidence retention to support consistent analyst decisions.
- Review provider and internal reporting to ensure false-positive rates, visibility limits, and response expectations are transparent to leadership.
Analyst notes and limits
This object is a detection analytic, not a technique description. Its main defensive lesson is that some pre-compromise detections are constrained by visibility and noise. The most useful local work is to define what evidence sources feed the analytic, how confidence is assigned, and how analysts avoid over-escalating common activity.
The supplied ATT&CK fields are sparse: no tactic, no official detection logic, no relationships, no aliases, and only the PRE platform are provided. This take therefore cannot identify a specific adversary behavior, data source, or control failure beyond the official warning about high occurrence, false positives, and limited visibility.
Analytic 1998
Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 036695ae110b… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1998Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.