DET0820: Detection of Client Configurations
This detection strategy matters because client configuration details can help an adversary tailor targeting before an intrusion. Even though the ATT&CK obj...
Analyst context for executives and security teams
This detection strategy matters because client configuration details can help an adversary tailor targeting before an intrusion. Even though the ATT&CK object has no official description or detection text, its relationship to T1592.004 indicates the defensive concern: identifying attempts to learn operating system/version, virtualization, architecture, language, time zone, and similar client attributes during reconnaissance.
Executive priority
Treat this as a reconnaissance-visibility and readiness question rather than a confirmed high-severity alert category. Leaders should ask whether the organization can prove what client-configuration information is exposed externally, where that exposure is logged, and how reconnaissance evidence is preserved for incident response, threat intelligence, and compliance narratives. The business value is reducing preventable targeting information and improving early warning before credential, endpoint, or vulnerability exploitation decisions are made by an adversary.
Technical view
SOC and detection teams should validate visibility around activity that could reveal client configuration details associated with T1592.004 Client Configurations. Because the detection strategy has no official detection logic, platforms, or tactics listed, teams should map local telemetry to the related technique context: reconnaissance against PRE-stage assets and collection of OS/version, virtualization, architecture, language, time zone, and related configuration indicators. Detection engineering should focus on environment-specific signals of enumeration, unusual requests for configuration-revealing resources, and correlation with other reconnaissance behaviors where available.
Likely telemetry
- External-facing web, application, and access logs that may reveal requests exposing client or environment configuration details
- Network and perimeter telemetry associated with reconnaissance or active scanning activity
- Asset inventory and exposure management data showing which client configuration details are externally discoverable
- Security monitoring events correlated to PRE-stage reconnaissance behavior
- Incident response evidence repositories that preserve source, timing, target, and requested resource context
Detection direction
- Start by documenting what client configuration attributes are exposed and where those exposures are logged.
- Build detections around abnormal or repeated attempts to retrieve configuration-revealing information, tuned against known benign scanners, monitoring tools, and inventory systems.
- Correlate suspected client-configuration discovery with other reconnaissance indicators rather than treating a single request as definitive malicious activity.
- Validate whether logs retain enough detail for investigation, including source, destination, timestamp, requested object, user agent or client metadata when applicable, and response outcome.
- Account for the ATT&CK object limitation: no official detection text, platforms, or tactics are supplied for DET0820, so local detection logic must be derived from the related T1592.004 context.
Mitigation priorities
- Reduce unnecessary public exposure of configuration details that disclose operating system, version, virtualization, architecture, language, time zone, or similar targeting information.
- Maintain accurate asset and exposure inventories so defenders know which client configuration data is intentionally or unintentionally visible.
- Ensure perimeter, application, and network logs are retained long enough to support reconnaissance investigations and compliance evidence.
- Use threat intelligence and incident response review to decide which reconnaissance patterns should become monitored use cases.
- Periodically test whether security teams can trace suspected configuration discovery activity from initial observation through triage and escalation.
Analyst notes and limits
DET0820 is a detection strategy object for Detection of Client Configurations and is related to ATT&CK technique T1592.004, Client Configurations, under reconnaissance for PRE platforms. The supplied ATT&CK fields do not include an official description or detection guidance for the detection strategy itself, so this take is intentionally framed around validation questions and defensible telemetry assumptions from the related technique.
The source object provides no official description, detection text, platforms, tactics, aliases, or labels for DET0820. The related technique description is the primary context. This summary does not assert active exploitation, attribution, specific affected technologies, or guaranteed detection coverage; local architecture and logging evidence are required.
Detection of Client Configurations
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1592.004 | Client Configurations Sub-technique | This object detects Client Configurations. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | d530e25399a1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack DET0820Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.