tfMITRE ATT&CK sub-technique

Server T1583.004

sub-technique of T1583 Acquire Infrastructure

Tactic: Resource Development
Platform: PRE
Version: 1.3
Created: 01 October 2020
Last modified: 12 May 2026
Contributor: Dor Edry, Microsoft

Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in Drive-by Compromise, enabling Phishing operations, or facilitating Command and Control. Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 20%

Threat groups80th percentile · 80% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 10%

Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Server MITRE reference T1583.004

Top 20%of all ATT&CK techniques for number of groups

9 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

ShinyHuntersG1057 ↗

Has used five IP addresses to host Python SimpleHTTP servers on port 8888, which exposed staging materials, customized agents, and .bash_history files.1

created 2026-07-291 referenceaka UNC6240

TeamPCPG1056 ↗

Has leased infrastructure specifically for offensive operations including Google assets in AS396982.1 2

created 2026-07-162 referencesaka PCPCat

VOID MANTICOREG1055 ↗

Has leveraged backend servers within Iran.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

Mustard TempestG1020 ↗

Has acquired servers to host second-stage payloads that remain active for a period of either days, weeks, or months.1

created 2023-12-061 referenceaka DEV-0206

CURIUMG1012 ↗

Has created dedicated servers for command and control and exfiltration purposes.1

created 2023-01-131 referenceaka Crimson Sandstorm

Earth LuscaG1006 ↗

Has acquired multiple servers for some of their operations, using each server for a different role.1

created 2022-07-011 referenceaka TAG-22

All 9 groups for this technique · 6 newest in this preview

Offense vs defense T1583.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Server detection strategy DET0871

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Server

Enterprise

1 platform

AN2003 · PRE

Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control. Once adversaries have provisioned a server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Response ContentDC0104	Internet Scan	None
Response MetadataDC0106	Internet Scan	None

Server detections T1583.004

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs