Acquire Infrastructure: Botnet (T1583.005) sits in the resource development tactic. It is a pre-compromise technique, so it applies to no operating system in particular. MITRE lists the platform as PRE.
The idea is simple. An adversary does not build the network of compromised machines. They buy, lease or rent one.
How attackers use it
MITRE describes a botnet as a network of compromised systems that can be told to perform coordinated tasks. Adversaries may buy a subscription to an existing botnet from a booter or stresser service.
MITRE notes that end-of-life, internet-facing edge devices and network appliances are commonly acquired for botnet use. Adversaries may also lease operational relay box (ORB) networks, made up of virtual private servers, small office and home office routers, or IoT devices.
With a botnet in hand, the follow-on activity MITRE lists includes large-scale phishing and distributed denial of service. A rented botnet can also support command and control by hiding infrastructure behind an established proxy network.
How to detect it
MITRE is direct about this one: most of the activity happens outside your visibility, so detecting the rental itself is difficult. The technique page points defenders at the stages that come after it.
- Phishing: watch inbound mail for volume spikes and unusual sending sources.
- Endpoint Denial of Service and Network Denial of Service: watch for traffic floods against your services from many unrelated addresses.
The record lists no data sources for this technique, which fits. Your useful telemetry belongs to the follow-on techniques, not to this one.
How to reduce the risk
MITRE's mitigation entry is Pre-compromise. It says this technique cannot be easily mitigated with preventive controls, because it relies on behavior outside the scope of enterprise defenses.
You can still shrink your own exposure to being part of someone else's botnet. This is general practice, not a MITRE mitigation.
- Retire edge devices and appliances that the manufacturer no longer supports.
- Keep routers, cameras and other IoT gear off flat, internet-reachable networks.
- Plan for denial of service ahead of time, with an upstream scrubbing or rate limiting arrangement and a tested runbook.
Quick check
Why does MITRE say detection of T1583.005 is difficult?
Because the adversary rents the botnet outside your environment. You do not see the purchase. Detection effort goes to later stages such as phishing and denial of service.
What kinds of devices does MITRE say are commonly acquired for botnets?
End-of-life, internet-facing edge devices and network appliances. ORB networks can also include VPS, SOHO routers and IoT devices.
