TA0042 · RESOURCE DEVELOPMENT
Acquire Access
Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.
Detect it with
Much of this takes place outside the visibility of the target organization, making detection difficult for defenders. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.
Why it matters on shift
Acquire Access is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context