TA0042 · RESOURCE DEVELOPMENT
Develop Capabilities
Building malware, exploits, and code-signing certificates in-house rather than buying them.
Detect it with
Not detectable at the victim. Consume threat intelligence and hunt the resulting hashes and TTPs.
Why it matters on shift
Develop Capabilities is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.
4 sub-techniques
How it shows up in practice
- T1587.001
Malware
Adversaries may develop malware and malware components that can be used during targeting.
- T1587.002
Code Signing Certificates
Adversaries may create self-signed code signing certificates that can be used during targeting.
- T1587.003
Digital Certificates
Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust.
- T1587.004
Exploits
Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.
Kill-chain context