Obtain Capabilities

Before compromising a victim, adversaries may buy or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Adversaries may purchase such capabilities from third-party entities, including technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.[1][2]

In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software SSL/TLS X.509 certificates and code signing certificates, or raiding closed databases of vulnerabilities or exploits.[3][4]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.

References

Attachments

ID
VT0009
MITRE ID
Sub-techniques
Tactic
Resource Development
Platforms
PRE
Version
1.0

Created: 20 December 2020

Last Modified: 20 December 2020