{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1584","id":"T1584","name":"Compromise Infrastructure","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1584","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"27c6958bcd686ebb7f008557947a7df52be063da21367f8e2e64eba4f6ee6e86","description":"Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\n\nUse of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Adversaries may also compromise numerous machines to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services or to form a botnet.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking) Additionally, adversaries may compromise infrastructure residing in close proximity to a target in order to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) via [Wi-Fi Networks](https://attack.mitre.org/techniques/T1669).(Citation: Nearest Neighbor Volexity)\n\nBy using compromised infrastructure, adversaries may enable follow-on malicious operations. Prior to targeting, adversaries may also compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1584","external_id":"T1584"},{"source_name":"amnesty_nso_pegasus","description":"Amnesty International Security Lab. (2021, July 18). Forensic Methodology Report: How to catch NSO Group’s Pegasus. Retrieved February 22, 2022.","url":"https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/"},{"source_name":"Sysdig Proxyjacking","description":"Crystal Morin. (2023, April 4). Proxyjacking has Entered the Chat. Retrieved July 6, 2023.","url":"https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited/"},{"source_name":"FireEye DNS Hijack 2019","description":"Hirani, M., Jones, S., Read, B. (2019, January 10). Global DNS Hijacking Campaign: DNS Record Manipulation at Scale. Retrieved October 9, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html"},{"source_name":"ICANNDomainNameHijacking","description":"ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved November 17, 2024.","url":"https://www.icann.org/en/ssac/registration-services/documents/sac-007-domain-name-hijacking-incidents-threats-risks-and-remediation-12-07-2005-en"},{"source_name":"Koczwara Beacon Hunting Sep 2021","description":"Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.","url":"https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"},{"source_name":"Nearest Neighbor Volexity","description":"Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025.","url":"https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"},{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"},{"source_name":"Talos DNSpionage Nov 2018","description":"Mercer, W., Rascagneres, P. (2018, November 27). DNSpionage Campaign Targets Middle East. Retrieved October 9, 2020.","url":"https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"},{"source_name":"NSA NCSC Turla OilRig","description":"NSA/NCSC. (2019, October 21). Cybersecurity Advisory: Turla Group Exploits Iranian APT To Expand Coverage Of Victims. Retrieved October 16, 2020.","url":"https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"},{"source_name":"Mandiant SCANdalous Jul 2020","description":"Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved November 17, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"},{"source_name":"ThreatConnect Infrastructure Dec 2020","description":"ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved September 17, 2026.","url":"https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"},{"source_name":"FireEye EPS Awakens Part 2","description":"Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.","url":"https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1584.001","id":"T1584.001","name":"Domains","page":"techniques/enterprise/T1584.001/"},{"key":"enterprise/T1584.002","id":"T1584.002","name":"DNS Server","page":"techniques/enterprise/T1584.002/"},{"key":"enterprise/T1584.003","id":"T1584.003","name":"Virtual Private Server","page":"techniques/enterprise/T1584.003/"},{"key":"enterprise/T1584.004","id":"T1584.004","name":"Server","page":"techniques/enterprise/T1584.004/"},{"key":"enterprise/T1584.005","id":"T1584.005","name":"Botnet","page":"techniques/enterprise/T1584.005/"},{"key":"enterprise/T1584.006","id":"T1584.006","name":"Web Services","page":"techniques/enterprise/T1584.006/"},{"key":"enterprise/T1584.007","id":"T1584.007","name":"Serverless","page":"techniques/enterprise/T1584.007/"},{"key":"enterprise/T1584.008","id":"T1584.008","name":"Network Devices","page":"techniques/enterprise/T1584.008/"}],"telemetry":[{"id":"DC0103","name":"Active DNS","page":"telemetry/DC0103/","kind":"attack_component","category":"Network and protocol telemetry","description":"DNS results obtained through active queries rather than a historical passive observation.","collection_focus":"Record authorized query name/type, resolver, request time, response code and returned records. Keep active-query results separate from evidence that a victim made the same query.","providers":[{"name":"ISC BIND dig","scope":"Explicit DNS lookups against a selected resolver; output contains answer and query context.","source_id":"dig"},{"name":"Zeek DNS logs","scope":"Passive corroboration when the active query crosses an authorized visible sensor.","source_id":"zeek"}],"configuration":["Select the owned lab resolver, allowed query names and record types. Use bounded queries, not unrestricted enumeration.","Retain full answer sections, response codes, TTLs, resolver address and query/collection timestamps; record cache and split-DNS context.","Store current resolutions separately from passive historical observations. Repeat only at an approved interval and record changes without inferring ownership."],"configuration_example":null,"required_fields":["query","rrtype","resolver","answer","response_code"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0103","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","resolver":"192.0.2.53","answer":"192.0.2.20","response_code":"NOERROR"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A resolution result is time- and resolver-dependent. Active queries generated by an analyst do not prove a target or adversary made those queries.","sources":[{"id":"dig","title":"ISC BIND dig DNS lookup utility","url":"https://bind9.readthedocs.io/en/latest/manpages.html#dig-dns-lookup-utility"},{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0101","name":"Domain Registration","page":"telemetry/DC0101/","kind":"attack_component","category":"External context and intelligence","description":"Domain registration records and changes used as infrastructure context.","collection_focus":"Query an approved RDAP service/feed, retaining retrieval time and registration-event dates; preserve redaction and missing-field indicators.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["domain","event","registrant","retrieved_at"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0101","collector":"illustrative-lab-collector","observation":{"domain":"example.test","event":"registration","registrant":"redacted","retrieved_at":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"attack_component","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"DC0096","name":"Passive DNS","page":"telemetry/DC0096/","kind":"attack_component","category":"Network and protocol telemetry","description":"Historically observed DNS answers from passive collection or an authorized passive-DNS feed.","collection_focus":"Collect permitted DNS observations with RR type, answer, first/last seen and sensor/source; distinguish local sensor history from a broader intelligence feed.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["query","rrtype","answer","first_seen","last_seen"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0096","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","answer":"192.0.2.20","first_seen":"2026-09-27T11:00:00Z","last_seen":"2026-09-27T12:00:00Z"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0104","name":"Response Content","page":"telemetry/DC0104/","kind":"attack_component","category":"Network and protocol telemetry","description":"Content returned by a queried service, such as an HTTP response body or banner.","collection_focus":"Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["service","response_excerpt","content_type","body_truncated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0106","name":"Response Metadata","page":"telemetry/DC0106/","kind":"attack_component","category":"Network and protocol telemetry","description":"Metadata about an Internet-facing resource inferred from authorized scan responses, such as open ports, services and reported versions.","collection_focus":"Preserve target, observation time, scan method and response evidence; distinguish inferred service identity from an authenticated software inventory.","providers":[{"name":"Nmap XML reports","scope":"Structured port/service observations from a separately authorized scan or existing report.","source_id":"nmap"},{"name":"Zeek protocol observations","scope":"Passive corroboration for visible service responses; not equivalent to active scan coverage.","source_id":"zeek"}],"configuration":["Use an existing authorized scan report or an explicitly approved isolated target set. Record tool/version, scan options, time window and scope.","Preserve native XML and normalized host/port/protocol/service fields. Disable XML external-entity resolution in downstream parsers.","Keep inferred service names/versions and their confidence separate from authenticated inventory; retain response evidence when available."],"configuration_example":null,"required_fields":["target","port","transport","service","version","observation_source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0106","collector":"illustrative-lab-collector","observation":{"target":"192.0.2.20","port":443,"transport":"tcp","service":"https","version":"not_identified","observation_source":"authorized_lab_scan"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A reported open port or banner is not a proven vulnerability. Filtered/no-response states can reflect routing or policy. The website performs no scans.","sources":[{"id":"nmap","title":"Nmap XML output specification","url":"https://nmap.org/book/output-formats-xml-output.html"},{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1584","id":"T1584","name":"Compromise Infrastructure","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1584","technique_page":"techniques/enterprise/T1584/","page":"detections/enterprise/T1584/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc","title":"Program Executions in Suspicious Folders","status":"test","level":"medium","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/a39d7fa7-3fbd-4dc2-97e1-d87f546b1bbc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"1ae64f96-72b6-48b3-ad3d-e71dff6c6398","title":"Suspicious External WebDAV Execution","status":"test","level":"high","logsource":{"category":"proxy"},"data_path":"data/detection-rules/1ae64f96-72b6-48b3-ad3d-e71dff6c6398.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_webdav_external_execution.yml","author":"Ahmed Farouk","kind":"sigma"},{"id":"13cfeb75-9e33-4d04-b0f7-ab8faaa95a59","title":"Windows Update Error","status":"stable","level":"informational","logsource":{"product":"windows","service":"system"},"data_path":"data/detection-rules/13cfeb75-9e33-4d04-b0f7-ab8faaa95a59.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0885","name":"Detection of Compromise Infrastructure","url":"https://attack.mitre.org/detectionstrategies/DET0885","stix_id":"x-mitre-detection-strategy--7f3e2c35-7394-4cc6-baef-73a830930953","relationship_id":"relationship--8d89d562-7ca0-4ba7-9ccc-dddbb7de1866","description":"","analytics":[{"id":"AN2017","name":"Analytic 2017","guidance":"Once adversaries have provisioned compromised infrastructure (ex: a server for use in command and control), internet scans may help proactively discover compromised infrastructure. Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.\nConsider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain. Efforts may need to be tailored to specific domains of interest as benign registration and resolution changes are a common occurrence on the internet.\nMonitor for queried domain name system (DNS) registry data that may compromise third-party infrastructure that can be used during targeting. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.\nMonitor for logged domain name system (DNS) data that may compromise third-party infrastructure that can be used during targeting. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.\nMonitor for contextual data about an Internet-facing resource gathered from a scan, such as running services or ports that may compromise third-party infrastructure that can be used during targeting. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.","url":"https://attack.mitre.org/detectionstrategies/DET0885#AN2017","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0104","component":"Response Content","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN2017","source_url":"https://attack.mitre.org/detectionstrategies/DET0885#AN2017","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0104/"},{"component_id":"DC0101","component":"Domain Registration","name":"Domain Name","channel":"None","platforms":["PRE"],"analytic_id":"AN2017","source_url":"https://attack.mitre.org/detectionstrategies/DET0885#AN2017","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0101/"},{"component_id":"DC0103","component":"Active DNS","name":"Domain Name","channel":"None","platforms":["PRE"],"analytic_id":"AN2017","source_url":"https://attack.mitre.org/detectionstrategies/DET0885#AN2017","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0103/"},{"component_id":"DC0096","component":"Passive DNS","name":"Domain Name","channel":"None","platforms":["PRE"],"analytic_id":"AN2017","source_url":"https://attack.mitre.org/detectionstrategies/DET0885#AN2017","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0096/"},{"component_id":"DC0106","component":"Response Metadata","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN2017","source_url":"https://attack.mitre.org/detectionstrategies/DET0885#AN2017","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0106/"}]}]}],"telemetry_references":[{"id":"DC0103","name":"Active DNS","tag":"Active DNS","page":"telemetry/DC0103/","kind":"attack_component"},{"id":"DC0101","name":"Domain Registration","tag":"Domain Registration","page":"telemetry/DC0101/","kind":"attack_component"},{"id":"DC0096","name":"Passive DNS","tag":"Passive DNS","page":"telemetry/DC0096/","kind":"attack_component"},{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"},{"id":"DC0106","name":"Response Metadata","tag":"Response Metadata","page":"telemetry/DC0106/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--f5f4cd1c-b71b-4cdd-ab7c-77a5981bb56b","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1588.004":"/ttp-simulation/techniques/enterprise/T1588.004/","T1566":"/ttp-simulation/techniques/enterprise/T1566/","T1090":"/ttp-simulation/techniques/enterprise/T1090/","T1669":"/ttp-simulation/techniques/enterprise/T1669/","T1584":"/ttp-simulation/techniques/enterprise/T1584/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1584","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0103","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","resolver":"192.0.2.53","answer":"192.0.2.20","response_code":"NOERROR"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0101","collector":"illustrative-lab-collector","observation":{"domain":"example.test","event":"registration","registrant":"redacted","retrieved_at":"2026-09-27T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0096","collector":"illustrative-lab-collector","observation":{"query":"lab.example.test","rrtype":"A","answer":"192.0.2.20","first_seen":"2026-09-27T11:00:00Z","last_seen":"2026-09-27T12:00:00Z"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0106","collector":"illustrative-lab-collector","observation":{"target":"192.0.2.20","port":443,"transport":"tcp","service":"https","version":"not_identified","observation_source":"authorized_lab_scan"}}]}}