Server (T1583.004) is a sub-technique of Acquire Infrastructure in the resource development tactic. The adversary buys, leases, rents or otherwise obtains physical servers to use in targeting. Platform: PRE.
How attackers use it
Servers let an adversary stage, launch and run an operation. MITRE lists uses such as watering hole operations in Drive-by Compromise (T1189), enabling phishing (T1566), and facilitating command and control. Instead of compromising a third party's server (T1584.004) or renting a VPS (T1583.003), the adversary may configure and run their own. MITRE adds that free trial periods of cloud servers may also be abused.
The setup can be light, if most activity happens on online infrastructure, or extensive, if they want to test, communicate with and control parts of their activity on systems of their own.
How to detect it
MITRE notes much of this happens outside the visibility of the target, so detection is hard. Two suggestions:
- Focus on related stages such as command and control.
- Use internet scans. Once an adversary has set up a server for C2, scans may reveal it. Look for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features or other response artifacts tied to adversary C2 software.
How to reduce the risk
MITRE lists one mitigation, pre-compromise, because the technique happens outside enterprise defenses and cannot easily be prevented. Practical steps are indirect: restrict outbound traffic, log DNS and network flows so you can look back when an indicator is published, and use threat intelligence that covers scan-derived server indicators.
Quick check
What is one way acquired servers get found?
Internet scans can reveal services, certificates and TLS negotiation features that match adversary C2 software.
