Compromise Infrastructure: Botnet (T1584.005) is a resource development technique tagged PRE. It is the build-your-own version of a botnet, compared with renting one.
How attackers use it
MITRE describes a botnet as a network of compromised systems that can be instructed to perform coordinated tasks. Instead of buying or renting from a booter or stresser service, adversaries may build their own by compromising numerous third-party systems.
They may also take over an existing botnet, for example by redirecting bots to adversary-controlled command and control servers. With a botnet at their disposal, they may carry out large-scale phishing or distributed denial of service.
How to detect it
As with the rented version, MITRE says that much of the activity is outside the visibility of the target organization. It suggests focusing on related stages: phishing, endpoint denial of service and network denial of service.
If your own device may be a bot, signs are usually local: unexplained outbound traffic, slow performance and unexpected processes. Your network logs are the best source for spotting a device that talks to many hosts it has no reason to know.
How to reduce the risk
MITRE lists Pre-compromise as the mitigation. Nothing you do can stop an adversary from assembling a botnet out of other people's machines.
Keeping your own systems out of one is general practice.
- Replace unsupported edge devices and IoT gear.
- Change default passwords and turn off remote administration you do not use.
- Patch routers and appliances, and subscribe to the vendor advisories.
- Block unexpected outbound connections from devices that only need a few destinations.
Quick check
How does T1584.005 differ from T1583.005?
In T1584.005 the adversary builds or takes over a botnet by compromising systems. In T1583.005 they buy or rent one.
Where should detection effort focus?
On related stages such as phishing and denial of service, because the building of the botnet is outside your visibility.
