Identify Business Tempo
Parent: T1591
Description
Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199))
Mapped SPARTA techniques
2 techniques
Operations cadence, pass schedules, shift patterns, LEOP windows, maintenance intervals — these are 'business tempo' indicators; T1591.003 'Identify Business Tempo' is the ATT&CK sub-technique that addresses operational-tempo reconnaissance.
Launch schedules, launch windows, and integration timelines are operational-tempo signals; T1591.003 'Identify Business Tempo' covers this dimension of launch reconnaissance, downgraded because T1591.002 (business relationships) is the dominant aspect of REC-0004.
Cite as SafeMode Space, mitre-attack-enterprise T1591.003.