MITRE ATT&CK Enterprise techniques whose primary tactic is Resource Development: detection with open-source tooling and cyber range exercises.
Detecting T1583 Acquire Infrastructure, using telemetry such as Response Content, Domain Registration and Response Metadata. Covers its 8 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1584 Compromise Infrastructure, using telemetry such as Response Content, Domain Registration and Response Metadata. Covers its 8 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1585 Establish Accounts, using telemetry such as Network Traffic Content and Social Media. Covers its 3 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1586 Compromise Accounts, using telemetry such as Network Traffic Content and Social Media. Covers its 3 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1587 Develop Capabilities, using telemetry such as Response Content, Malware Metadata and Malware Content. Covers its 4 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1588 Obtain Capabilities, using telemetry such as Response Content, Malware Content and Malware Metadata. Covers its 7 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1608 Stage Capabilities, using telemetry such as Response Content. Covers its 7 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Detecting T1650 Acquire Access. Covers the ATT&CK mitigation Pre-compromise and how to rehearse the detection in a cyber range.
Detecting T1683 Generate Content. Covers its 2 sub-techniques, the ATT&CK mitigation Pre-compromise, and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.