tfMITRE ATT&CK technique

Acquire Infrastructure T1583

Tactic: Resource Development
Platform: PRE
Version: 1.5
Created: 30 September 2020
Last modified: 24 October 2025
Contributors: Shailesh Tiwary (Indian Army); Menachem Goldstein

Sub-techniques 82 rules across the family · 0 mapped directly to T1583 · 1 of 8 carry rules

.001Domains0 .002DNS Server0 .003Virtual Private Server0 .004Server0 .005Botnet0 .006Web Services2 .007Serverless0 .008Malvertising0

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.[1] Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.[2] Additionally, botnets are available for rent or purchase.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 20%

Threat groups80th percentile · 79% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 32% of ATT&CK techniques have none either.

Offense vs defense T1583

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Passive DNSDC0096	Domain Name	—
Domain RegistrationDC0101	Domain Name	—
Active DNSDC0103	Domain Name	—
Response ContentDC0104	Internet Scan	—
Response MetadataDC0106	Internet Scan	—

Data component

Name

Channel

Passive DNSDC0096

Domain Name

—

Domain RegistrationDC0101

Domain Name

—

Active DNSDC0103

Domain Name

—

Response ContentDC0104

Internet Scan

—

Response MetadataDC0106

Internet Scan

—

Offense vs defense T1583

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Data component	Name	Channel
Passive DNSDC0096	Domain Name	—
Domain RegistrationDC0101	Domain Name	—
Active DNSDC0103	Domain Name	—
Response ContentDC0104	Internet Scan	—
Response MetadataDC0106	Internet Scan	—

Data component

Name

Channel

Passive DNSDC0096

Domain Name

—

Domain RegistrationDC0101

Domain Name

—

Active DNSDC0103

Domain Name

—

Response ContentDC0104

Internet Scan

—

Response MetadataDC0106

Internet Scan

—

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
No rules found. Try adjusting your filters.

Title

Description

Acquire Infrastructure T1583

Acquire Infrastructure T1583

Acquire Infrastructure MITRE reference T1583

Offense vs defense T1583

Acquire Infrastructure detection strategy DET0895

Detection of Acquire Infrastructure

Log sources

Acquire Infrastructure MITRE reference T1583

Offense vs defense T1583

Acquire Infrastructure detection strategy DET0895

Detection of Acquire Infrastructure

Log sources

Acquire Infrastructure detections T1583

Acquire Infrastructure detections T1583