tfMITRE ATT&CK technique

Obtain Capabilities T1588

Tactic: Resource Development
Platform: PRE
Version: 1.1
Created: 01 October 2020
Last modified: 24 October 2025

Sub-techniques 716 rules across the family · 2 mapped directly to T1588 · 3 of 7 carry rules

.001Malware1 .002Tool12 .003Code Signing Certificates0 .004Digital Certificates1 .005Exploits0 .006Vulnerabilities0 .007Artificial Intelligence0

Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Offense vs defense T1588

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

Data component	Name	Channel
Malware MetadataDC0003	Malware Repository	—
Malware ContentDC0011	Malware Repository	—
Certificate RegistrationDC0093	Certificate	—
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Malware MetadataDC0003

Malware Repository

—

Malware ContentDC0011

Malware Repository

—

Certificate RegistrationDC0093

Certificate

—

Response ContentDC0104

Internet Scan

—

Offense vs defense T1588

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0

Data component	Name	Channel
Malware MetadataDC0003	Malware Repository	—
Malware ContentDC0011	Malware Repository	—
Certificate RegistrationDC0093	Certificate	—
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Malware MetadataDC0003

Malware Repository

—

Malware ContentDC0011

Malware Repository

—

Certificate RegistrationDC0093

Certificate

—

Response ContentDC0104

Internet Scan

—

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
		Detects an Antivirus alert in a highly relevant file path or with a relevant file name. (...)	Generic	test	antivirus	-	-	Resource Development Obtain Capabilities	-	high	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-29	c9a88268-0047-4824-ba6e-4d81ce0b907c
		Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.	Generic	test	-	windows	WinEventLog Application	Resource Development Obtain Capabilities	-	high	Florian Roth (Nextron Systems), Arnim Rupp	2017-02-19	2026-10-12	78bc5783-81d9-4d73-ac97-59f6db4f72a8

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
		Detects an Antivirus alert in a highly relevant file path or with a relevant file name. (...)	Generic	test	antivirus	-	-	Resource Development Obtain Capabilities	-	high	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-29	c9a88268-0047-4824-ba6e-4d81ce0b907c
		Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.	Generic	test	-	windows	WinEventLog Application	Resource Development Obtain Capabilities	-	high	Florian Roth (Nextron Systems), Arnim Rupp	2017-02-19	2026-10-12	78bc5783-81d9-4d73-ac97-59f6db4f72a8

Obtain Capabilities T1588

Obtain Capabilities T1588

Offense vs defense T1588

Obtain Capabilities detection strategy DET0850

Detection of Obtain Capabilities

Log sources

Offense vs defense T1588

Obtain Capabilities detection strategy DET0850

Detection of Obtain Capabilities

Log sources

Obtain Capabilities detections T1588

Obtain Capabilities detections T1588