ATT&CK Reference
Portfolio

TA0042 · RESOURCE DEVELOPMENT

Obtain Capabilities

T1588PREattack.mitre.org

Purchasing tooling, exploits, certificates, or already-established access to your network.

Detect it with

Dark-web and broker monitoring for your own domain and VPN ranges appearing for sale.

Why it matters on shift

Obtain Capabilities is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.

7 sub-techniques

How it shows up in practice

  1. T1588.001

    Malware

    Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols.

  2. T1588.002

    Tool

    Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial.

  3. T1588.003

    Code Signing Certificates

    Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted.

  4. T1588.004

    Digital Certificates

    Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust.

  5. T1588.005

    Exploits

    Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.

  6. T1588.006

    Vulnerabilities

    Adversaries may acquire information about vulnerabilities that can be used during targeting.

  7. T1588.007

    Artificial Intelligence

    Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting.

Kill-chain context

← beforeReconnaissanceResource Developmentafter →Initial Access