TA0042 · RESOURCE DEVELOPMENT
Acquire Infrastructure
Domains, VPS instances, botnets, web services, and serverless functions purchased for the operation.
Detect it with
Proxy alerting on newly observed domains (< 30 days registered); traffic to low-reputation hosting ASNs.
Why it matters on shift
Acquire Infrastructure is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.
8 sub-techniques
How it shows up in practice
- T1583.001
Domains
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses.
- T1583.002
DNS Server
Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol).
- T1583.003
Virtual Private Server
Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service.
- T1583.004
Server
Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation.
- T1583.005
Botnet
Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.
- T1583.006
Web Services
Adversaries may register for web services that can be used during targeting.
- T1583.007
Serverless
Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting.
- T1583.008
Malvertising
Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results.
Kill-chain context