Acquire Infrastructure (T1583) is a technique in the resource development tactic. Resource development happens before the attack reaches you. The adversary buys, leases, rents or otherwise obtains infrastructure to use during targeting. MITRE lists the platform as PRE, meaning pre-compromise.
This is the one technique in the series where most of the activity is invisible to you. That changes how the post is organized: less about logs on your hosts, more about watching the public footprints and tightening what the infrastructure will eventually touch.
How attackers use it
MITRE describes a wide range of infrastructure for hosting and orchestrating operations: physical or cloud servers, domains and third-party web services. Some providers offer free trial periods, so acquisition can cost little or nothing. Botnets are available for rent or purchase.
The benefits for the adversary, as MITRE lists them:
- The ability to stage, launch and execute operations
- Blending in with normal traffic, for example by contacting third-party web services, or by acquiring infrastructure to support a proxy (T1090), including residential proxy services
- Infrastructure that is hard to tie back to them physically
- Infrastructure that can be provisioned, changed and shut down quickly
The sub-techniques, each with a post in this series, are Domains (T1583.001), DNS Server (T1583.002), Virtual Private Server (T1583.003) and Server (T1583.004). Other sub-techniques exist for areas such as web services and botnets.
How to detect it
MITRE's detection notes are candid: much of this takes place outside your visibility. They suggest focusing on later stages of the lifecycle, especially command and control, and on public data.
Public data sources named by MITRE:
- Internet scan data. Once an adversary has set up a server for command and control, internet-wide scans may reveal it. Look for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features or other response artifacts tied to adversary C2 software.
- DNS registry data. Monitor queried DNS registry data for domains that could be used in targeting.
- Logged DNS data. Monitor your own DNS logs for related names.
- WHOIS. Use services that track newly acquired infrastructure, such as WHOIS databases for domain registration information.
On a small team, that usually reduces to: send DNS logs to a central place, flag newly registered or rarely seen domains, and subscribe to a threat intelligence feed that does the internet scanning for you.
How to reduce the risk
MITRE lists one mitigation, Pre-compromise, and says the technique cannot easily be mitigated with preventive controls, because it is behavior outside the scope of enterprise defenses.
So the defensive goal shifts. You cannot stop an adversary from renting a server. You can make the rented server less useful:
- Restrict outbound traffic so hosts can only reach destinations they need.
- Filter by domain reputation and age where your tooling supports it.
- Log and review DNS. Newly seen domains are a good hunting starting point.
- Train people on lookalike domains for phishing, since acquired domains often serve that purpose (see T1583.001).
Check your own environment
- Do DNS queries from servers and endpoints go to a resolver you log?
- Can you query "first seen" information for a domain a user has visited?
- Do servers have unrestricted outbound access to the internet?
- Does your threat intelligence source cover scan-derived C2 server indicators?
- Is there a process to block a newly reported indicator within hours?
Quick check
Why can this technique not be prevented with ordinary controls?
It happens before the attack, outside your network, in the adversary's own purchases and rentals. MITRE notes it is behavior outside the scope of enterprise defenses.
Where does MITRE suggest focusing detection instead?
On later stages of the adversary lifecycle, mainly command and control, using internet scan data, DNS data and domain registration information.
