Resource Development

Domains, VPS instances, botnets, web services, and serverless functions purchased for the operation.

Detect it with
Proxy alerting on newly observed domains (< 30 days registered); traffic to low-reputation hosting ASNs.

Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services.

Detect it with
Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain.

Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations.

Detect it with
Consider monitoring social media activity related to your organization. Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.

Taking over legitimate email or social accounts so that later phishing arrives from a trusted sender.

Detect it with
Inbound mail passing SPF/DKIM from a real partner domain but with anomalous language or an unexpected attachment.

Building malware, exploits, and code-signing certificates in-house rather than buying them.

Detect it with
Not detectable at the victim. Consume threat intelligence and hunt the resulting hashes and TTPs.

Purchasing tooling, exploits, certificates, or already-established access to your network.

Detect it with
Dark-web and broker monitoring for your own domain and VPN ranges appearing for sale.

Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.

Detect it with
If infrastructure or patterns in malware, tooling, certificates, or malicious web content have been previously identified, internet scanning may uncover when an adversary has staged their capabilities.

Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.

Detect it with
Much of this takes place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.