TA0042 · RESOURCE DEVELOPMENT
Drive-by Target
Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise.
Detect it with
If infrastructure or patterns in the malicious web content utilized to deliver a Drive-by Compromise have been previously identified, internet scanning may uncover when an adversary has staged web content for use in a strategic web compromise.
Why it matters on shift
Drive-by Target is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context