tfMITRE ATT&CK technique

Develop Capabilities T1587

Tactic: Resource Development
Platform: PRE
Version: 1.1
Created: 01 October 2020
Last modified: 24 October 2025

Sub-techniques 420 rules across the family · 6 mapped directly to T1587 · 3 of 4 carry rules

.001Malware12 .002Code Signing Certificates1 .003Digital Certificates1 .004Exploits0

Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.[1][2][3][4]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules67th pct

Detection rules67th percentile · 64% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1587

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 0

Data component	Name	Channel
Malware MetadataDC0003	Malware Repository	—
Malware ContentDC0011	Malware Repository	—
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Malware MetadataDC0003

Malware Repository

—

Malware ContentDC0011

Malware Repository

—

Response ContentDC0104

Internet Scan

—

Offense vs defense T1587

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 0

Data component	Name	Channel
Malware MetadataDC0003	Malware Repository	—
Malware ContentDC0011	Malware Repository	—
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Malware MetadataDC0003

Malware Repository

—

Malware ContentDC0011

Malware Repository

—

Response ContentDC0104

Internet Scan

—

Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675	Emerging	test	file_event	windows	Sysmon	Resource Development Develop Capabilities	CVE-2021-1675	critical	Florian Roth (Nextron Systems)	2021-06-29	2022-12-25	2131cfb3-8c12-45e8-8fa0-31f5924e9f07
Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. (...)	Emerging	test	image_load	windows	Sysmon	Resource Development Develop Capabilities	-	critical	Florian Roth (Nextron Systems)	2021-09-27	2022-12-09	640dc51c-7713-4faa-8a0e-e7c0d9d4654c
Detects the execution of the PurpleSharp adversary simulation tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Develop Capabilities	-	critical	Florian Roth (Nextron Systems)	2021-06-18	2023-02-05	ff23ffbc-3378-435e-992f-0624dcf93ab4
Detects known hacktool execution based on image name.	Generic	test	process_creation	linux	Sysmon	Resource Development Develop Capabilities	-	high	Nasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure])	2023-01-03	2024-09-19	a015e032-146d-4717-8944-7a1884122111
Detects program executions in suspicious non-program folders related to malware or hacking activity	Generic	test	process_creation	linux	Linux Auditd	Resource Development Compromise Infrastructure Resource Development Develop Capabilities	-	medium	Florian Roth (Nextron Systems)	2018-01-23	2021-11-27	a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc
Detects file creation patterns noticeable during the exploitation of CVE-2021-40444	Emerging	test	file_event	windows	Sysmon	Resource Development Develop Capabilities	CVE-2021-40444	high	Florian Roth (Nextron Systems), Sittikorn S	2021-09-10	2023-06-22	60c0a111-787a-4e8a-9262-ee485f3ef9d5

Title

Description

Develop Capabilities T1587

Develop Capabilities T1587

Develop Capabilities MITRE reference T1587

Offense vs defense T1587

Develop Capabilities detection strategy DET0853

Detection of Develop Capabilities

Log sources

Develop Capabilities MITRE reference T1587

Offense vs defense T1587

Develop Capabilities detection strategy DET0853

Detection of Develop Capabilities

Log sources

Develop Capabilities detections T1587

Develop Capabilities detections T1587