{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1588","id":"T1588","name":"Obtain Capabilities","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1588","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"25470e5e6700660934464d64c94afeb2455c0898826bd312eb5dbc84f7bc88dd","description":"Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.\n\nIn addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab)\n\nIn addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1588","external_id":"T1588"},{"source_name":"PegasusCitizenLab","description":"Bill Marczak and John Scott-Railton. (2016, August 24). The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender. Retrieved December 12, 2016.","url":"https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/"},{"source_name":"FireEyeSupplyChain","description":"FireEye. (2014). SUPPLY CHAIN ANALYSIS: From Quartermaster to SunshopFireEye. Retrieved March 6, 2017.","url":"https://www.mandiant.com/resources/supply-chain-analysis-from-quartermaster-to-sunshop"},{"source_name":"DiginotarCompromise","description":"Fisher, D. (2012, October 31). Final Report on DigiNotar Hack Shows Total Compromise of CA Servers. Retrieved March 6, 2017.","url":"https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/"},{"source_name":"Recorded Future Beacon Certificates","description":"Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved September 16, 2024.","url":"https://www.recordedfuture.com/research/cobalt-strike-servers"},{"source_name":"Splunk Kovar Certificates 2017","description":"Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL Certificates. Retrieved October 16, 2020.","url":"https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html"},{"source_name":"Analyzing CS Dec 2020","description":"Maynier, E. (2020, December 20). Analyzing Cobalt Strike for Fun and Profit. Retrieved October 12, 2021.","url":"https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/"},{"source_name":"NationsBuying","description":"Nicole Perlroth and David E. Sanger. (2013, July 12). Nations Buying as Hackers Sell Flaws in Computer Code. Retrieved March 9, 2017.","url":"https://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1588.001","id":"T1588.001","name":"Malware","page":"techniques/enterprise/T1588.001/"},{"key":"enterprise/T1588.002","id":"T1588.002","name":"Tool","page":"techniques/enterprise/T1588.002/"},{"key":"enterprise/T1588.003","id":"T1588.003","name":"Code Signing Certificates","page":"techniques/enterprise/T1588.003/"},{"key":"enterprise/T1588.004","id":"T1588.004","name":"Digital Certificates","page":"techniques/enterprise/T1588.004/"},{"key":"enterprise/T1588.005","id":"T1588.005","name":"Exploits","page":"techniques/enterprise/T1588.005/"},{"key":"enterprise/T1588.006","id":"T1588.006","name":"Vulnerabilities","page":"techniques/enterprise/T1588.006/"},{"key":"enterprise/T1588.007","id":"T1588.007","name":"Artificial Intelligence","page":"techniques/enterprise/T1588.007/"}],"telemetry":[{"id":"DC0093","name":"Certificate Registration","page":"telemetry/DC0093/","kind":"attack_component","category":"External context and intelligence","description":"Certificate issuance/registration context for infrastructure discovery and investigation.","collection_focus":"Ingest authorized certificate/CA or transparency observations with fingerprint, names, issuer and observation/issuance times; do not collect private keys.","providers":[{"name":"Certificate Transparency logs / monitors","scope":"Public certificate observations; not proof of ownership or compromise.","source_id":"ct"},{"name":"Authorized CA inventory exports","scope":"Customer-controlled certificate state; revocation/expiry need their own checks.","source_id":"ct"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["certificate_sha256","dns_names","issuer","observation_source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0093","collector":"illustrative-lab-collector","observation":{"certificate_sha256":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","dns_names":["lab.example.test"],"issuer":"Lab Test CA","observation_source":"lab-ca-export"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"},{"id":"ct","title":"Certificate Transparency project","url":"https://certificate.transparency.dev/"}],"association":"attack_component","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"DC0011","name":"Malware Content","page":"telemetry/DC0011/","kind":"attack_component","category":"Sample analysis and intelligence","description":"The bytes or extracted content of a malware sample used in analysis, rather than only its filename or verdict.","collection_focus":"Use an isolated sample repository and authorized analysis tooling; preserve hashes, extraction method and custody. Do not execute samples to populate this page.","providers":[{"name":"YARA","scope":"Static rule matches and matched strings on authorized files; not proof of execution or attribution.","source_id":"yara"},{"name":"Authorized sample repositories / STIX analysis reports","scope":"Sample identity, provenance and analysis observations; access and retention are separately controlled.","source_id":"stix"}],"configuration":["Work offline with an authorized sample or benign fixture; record its SHA-256, origin and custody before analysis.","For static matching, pin reviewed YARA rules/tool version and capture match IDs and offsets where needed. Treat untrusted rules and samples as untrusted input.","Store sanitized findings separately from restricted sample bytes. Label static observations, verdicts and any independently obtained dynamic results distinctly."],"configuration_example":null,"required_fields":["sample_sha256","artifact_kind","content","offset"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0011","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","artifact_kind":"extracted_string","content":"BENIGN LAB MARKER","offset":4096}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A rule match is not a confirmed infection. Metadata is not payload content, and static analysis does not prove a behavior occurred on a victim. No samples are executed by this module.","sources":[{"id":"yara","title":"YARA command-line analysis","url":"https://yara.readthedocs.io/en/stable/commandline.html"},{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"}],"association":"attack_component","anomaly_design":"Compare sample metadata, behavior traces and structural characteristics against an appropriate analysis corpus. Sample availability and sandbox execution differ from observing a compromise on a protected asset."},{"id":"DC0003","name":"Malware Metadata","page":"telemetry/DC0003/","kind":"attack_component","category":"Sample analysis and intelligence","description":"Descriptive attributes of a suspicious software sample or malware analysis record.","collection_focus":"Ingest permitted analysis metadata with sample hash, tool/version, submission provenance and confidence; keep verdicts separate from observed facts.","providers":[{"name":"YARA","scope":"Static rule matches and matched strings on authorized files; not proof of execution or attribution.","source_id":"yara"},{"name":"Authorized sample repositories / STIX analysis reports","scope":"Sample identity, provenance and analysis observations; access and retention are separately controlled.","source_id":"stix"}],"configuration":["Work offline with an authorized sample or benign fixture; record its SHA-256, origin and custody before analysis.","For static matching, pin reviewed YARA rules/tool version and capture match IDs and offsets where needed. Treat untrusted rules and samples as untrusted input.","Store sanitized findings separately from restricted sample bytes. Label static observations, verdicts and any independently obtained dynamic results distinctly."],"configuration_example":null,"required_fields":["sample_sha256","file_type","analysis_status","verdict"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0003","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","file_type":"PE32","analysis_status":"static_only","verdict":"undetermined"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A rule match is not a confirmed infection. Metadata is not payload content, and static analysis does not prove a behavior occurred on a victim. No samples are executed by this module.","sources":[{"id":"yara","title":"YARA command-line analysis","url":"https://yara.readthedocs.io/en/stable/commandline.html"},{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"}],"association":"attack_component","anomaly_design":"Compare sample metadata, behavior traces and structural characteristics against an appropriate analysis corpus. Sample availability and sandbox execution differ from observing a compromise on a protected asset."},{"id":"DC0104","name":"Response Content","page":"telemetry/DC0104/","kind":"attack_component","category":"Network and protocol telemetry","description":"Content returned by a queried service, such as an HTTP response body or banner.","collection_focus":"Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["service","response_excerpt","content_type","body_truncated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1588","id":"T1588","name":"Obtain Capabilities","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1588","technique_page":"techniques/enterprise/T1588/","page":"detections/enterprise/T1588/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"c9a88268-0047-4824-ba6e-4d81ce0b907c","title":"Antivirus Relevant File Paths Alerts","status":"test","level":"high","logsource":{"category":"antivirus"},"data_path":"data/detection-rules/c9a88268-0047-4824-ba6e-4d81ce0b907c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/category/antivirus/av_relevant_files.yml","author":"Florian Roth (Nextron Systems), Arnim Rupp","kind":"sigma"},{"id":"78bc5783-81d9-4d73-ac97-59f6db4f72a8","title":"Relevant Anti-Virus Signature Keywords In Application Log","status":"test","level":"high","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/78bc5783-81d9-4d73-ac97-59f6db4f72a8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/Other/win_av_relevant_match.yml","author":"Florian Roth (Nextron Systems), Arnim Rupp","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0850","name":"Detection of Obtain Capabilities","url":"https://attack.mitre.org/detectionstrategies/DET0850","stix_id":"x-mitre-detection-strategy--4e940cf7-b024-40d4-8b1f-f516588b08fa","relationship_id":"relationship--ff6ff6a3-7bdf-449c-ac49-04e76dc389c5","description":"","analytics":[{"id":"AN1982","name":"Analytic 1982","guidance":"Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure. Some server-side components of adversary tools may have default values set for SSL/TLS certificates. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.\nMonitor for contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.\nMonitor for logged network traffic in response to a scan showing both protocol header and body values that may buy and/or steal capabilities that can be used during targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.\nConsider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific Malware-as-a-Service (MaaS) offerings. Malware repositories can also be used to identify additional samples associated with the developers and the adversary utilizing their services. Identifying overlaps in malware use by different adversaries may indicate malware was obtained by the adversary rather than developed by them. In some cases, identifying overlapping characteristics in malware used by different adversaries may point to a shared quartermaster. Malware repositories can also be used to identify features of tool use associated with an adversary, such as watermarks in Cobalt Strike payloads.","url":"https://attack.mitre.org/detectionstrategies/DET0850#AN1982","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0093","component":"Certificate Registration","name":"Certificate","channel":"None","platforms":["PRE"],"analytic_id":"AN1982","source_url":"https://attack.mitre.org/detectionstrategies/DET0850#AN1982","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0093/"},{"component_id":"DC0003","component":"Malware Metadata","name":"Malware Repository","channel":"None","platforms":["PRE"],"analytic_id":"AN1982","source_url":"https://attack.mitre.org/detectionstrategies/DET0850#AN1982","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0003/"},{"component_id":"DC0104","component":"Response Content","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN1982","source_url":"https://attack.mitre.org/detectionstrategies/DET0850#AN1982","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0104/"},{"component_id":"DC0011","component":"Malware Content","name":"Malware Repository","channel":"None","platforms":["PRE"],"analytic_id":"AN1982","source_url":"https://attack.mitre.org/detectionstrategies/DET0850#AN1982","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0011/"}]}]}],"telemetry_references":[{"id":"DC0093","name":"Certificate Registration","tag":"Certificate Registration","page":"telemetry/DC0093/","kind":"attack_component"},{"id":"DC0011","name":"Malware Content","tag":"Malware Content","page":"telemetry/DC0011/","kind":"attack_component"},{"id":"DC0003","name":"Malware Metadata","tag":"Malware Metadata","page":"telemetry/DC0003/","kind":"attack_component"},{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--d40b183e-3714-4e2c-a738-caff2db7054a","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1588":"/ttp-simulation/techniques/enterprise/T1588/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1588","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0093","collector":"illustrative-lab-collector","observation":{"certificate_sha256":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","dns_names":["lab.example.test"],"issuer":"Lab Test CA","observation_source":"lab-ca-export"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0011","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","artifact_kind":"extracted_string","content":"BENIGN LAB MARKER","offset":4096}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0003","collector":"illustrative-lab-collector","observation":{"sample_sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","file_type":"PE32","analysis_status":"static_only","verdict":"undetermined"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}}]}}