t1584-compromise-infrastructure

name	T1584_compromise-infrastructure
description	Adversaries may compromise third-party infrastructure that can be used during targeting.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1584","resource-development","pre"]
technique_id	T1584
tactic	resource-development
all_tactics	["resource-development"]
platforms	["PRE"]
mitre_url	https://attack.mitre.org/techniques/T1584
tech_stack	["pre"]
cwe_ids	[]
chains_with	["T1584.001","T1584.002","T1584.003","T1584.004","T1584.005","T1584.006","T1584.007","T1584.008"]
prerequisites	[]
severity_boost	{"T1584.001":"Chain with T1584.001 for deeper attack path","T1584.002":"Chain with T1584.002 for deeper attack path","T1584.003":"Chain with T1584.003 for deeper attack path"}

T1584 Compromise Infrastructure

High-Level Description

Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

Use of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns. Adversaries may also compromise numerous machines to support Proxy and/or proxyware services or to form a botnet. Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain Initial Access via Wi-Fi Networks.

By using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.

Kill Chain Phase

• Resource Development (TA0042)

Platforms: PRE

What to Check

• Identify if Compromise Infrastructure technique is applicable to target environment
• Check PRE systems for indicators of Compromise Infrastructure
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Compromise Infrastructure by examining the target platforms (PRE).

2. Assess Existing Defenses: Review whether mitigations for T1584 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See for updates.