Generate Content (T1683) is a Resource Development technique. Adversaries create content to support targeting and operations. MITRE lists PRE as the platform, because this preparation happens before contact with the victim.
How attackers use it
The content can establish personas, impersonate known individuals or organizations, and support Social Engineering (T1684), fraud or influence activity. It may be written, audio, images, video or other media, tailored to the target and goal.
MITRE says content can be made in-house, bought from third parties, or produced with AI-assisted tools. Adversaries may use AI to research targets and develop pretexts first (see Query Public AI Services, T1682).
The content then supports other techniques, including Phishing (T1566), Phishing for Information (T1598), Financial Theft (T1657) and Establish Accounts (T1585). MITRE draws one boundary: generated content does not include malicious code or scripts, which fall under Develop Capabilities (T1587).
The technique has two sub-techniques, Written Content (T1683.001) and Audio-Visual Content (T1683.002). MITRE's examples include an adversary using an AI coding tool to write documentation of its own operation, and malware that produced a file mapping harvested credentials to internal servers.
How to detect it
MITRE notes that most of this takes place outside the target's visibility. Detection efforts are better focused on related stages such as Initial Access.
How to reduce the risk
The Pre-compromise mitigation applies. The behavior cannot be easily prevented, and defenses should not depend on atomic indicators.
Put effort where you have control:
- Verify requests that involve money, credentials or access through a second channel.
- Do not treat polish, correct grammar or a familiar writing style as evidence of a real sender.
- Use email authentication so that spoofed domains fail checks (see Email Spoofing, T1684.002).
- Train people on the full range of lures, including voice and video.
Quick check
Does Generate Content include malware?
No. MITRE says generated content does not include malicious code or scripts. Those are covered by Develop Capabilities (T1587).
Sources
- MITRE ATT&CK, Generate Content (T1683): https://attack.mitre.org/techniques/T1683
