{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1683","id":"T1683","name":"Generate Content","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1683","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"e14c7efe5fd26641767cbf3b02500667328148959dff025655d5343e9cd3722e","description":"Adversaries may create or generate content to support targeting and operations. This content may be used to establish personas, impersonate known individuals or organizations, and support [Social Engineering](https://attack.mitre.org/techniques/T1684), fraud, or influence activities. Written materials, audio, images, video, or other media may be developed and tailored to the target and objective.(Citation: IBM AI-Generated Content)\n\nContent development may occur prior to or during an operation. Adversaries may develop or generate content in-house, source it through third parties, or produce it using AI-assisted tools. Adversaries may use AI to research targets, develop pretexts, and better understand the organizations and individuals they intend to target or deceive prior to generating content (i.e., [Query Public AI Services](https://attack.mitre.org/techniques/T1682)); for obtaining access to AI tools used in content generation, see [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007). \n\nContent may be leveraged in support of techniques such as [Phishing](https://attack.mitre.org/techniques/T1566), [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Social Engineering](https://attack.mitre.org/techniques/T1684), [Financial Theft](https://attack.mitre.org/techniques/T1657), or [Establish Accounts](https://attack.mitre.org/techniques/T1585). Generated or developed content does not include malicious code or scripts (i.e., [Develop Capabilities](https://attack.mitre.org/techniques/T1587) and [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007)).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1683","external_id":"T1683"},{"source_name":"IBM AI-Generated Content","description":"Tim Mucci. (n.d.). What is AI-Generated Content?. Retrieved April 22, 2026.","url":"https://www.ibm.com/think/insights/ai-generated-content"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","parent":null,"children":[{"key":"enterprise/T1683.001","id":"T1683.001","name":"Written Content","page":"techniques/enterprise/T1683.001/"},{"key":"enterprise/T1683.002","id":"T1683.002","name":"Audio-Visual Content","page":"techniques/enterprise/T1683.002/"}],"telemetry":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input","category":"External context and intelligence","description":"External observations that may contextualize adversary preparation but do not show access to a victim.","collection_focus":"Retain source provenance, confidence and temporal bounds; explicitly label observations outside victim visibility.","providers":[{"name":"Authorized intelligence feeds / STIX repositories","scope":"Provenance-bearing observations and analysis, not direct victim-side logs.","source_id":"stix"},{"name":"RDAP registries/registrars","scope":"Registration context; public fields can be redacted or unavailable.","source_id":"rdap"}],"configuration":["Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.","Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.","Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone."],"configuration_example":null,"required_fields":["indicator","source_record","confidence","victim_access_observed"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.","sources":[{"id":"stix","title":"OASIS STIX 2.1 specification","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html"},{"id":"rdap","title":"ICANN Registration Data Access Protocol","url":"https://www.icann.org/en/contracted-parties/registry-operators/resources/registration-data-access-protocol"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input","category":"External context and intelligence","description":"Audit records controlled by an external provider that may only be available through an authorized disclosure or account-owner export.","collection_focus":"Document legal/account-owner access and provider coverage before ingestion. Preserve original IDs, timestamps and disclosure limits; do not seek unauthorized access.","providers":[{"name":"Authorized provider/account-owner audit exports","scope":"Available only with the provider or account owner’s lawful access and supported export.","source_id":"cloudtrail"},{"name":"CloudTrail in an owned lab account","scope":"A concrete lab-side example; it does not grant access to adversary-controlled accounts.","source_id":"cloudtrail"}],"configuration":["Establish the authorized account, record owner and export mechanism before collection. Without access, mark this input unavailable rather than simulating defender visibility.","Preserve source event IDs, account/resource IDs, original timestamps and the authorized disclosure/export record.","Document which events the provider actually exposes and compare delivered records to the request scope. Keep lab-side actions separate from victim-side evidence."],"configuration_example":null,"required_fields":["provider_record_id","access_basis","action","victim_network_observation"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Customer-accessible audit APIs do not expose arbitrary third-party accounts. A synthetic provider event cannot establish access, attribution or detection coverage in a real investigation.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"}],"association":"proposed_input","anomaly_design":"Changes in external infrastructure, registration or published intelligence can supply context. They do not expose private attacker actions or establish a victim-side detector; preserve timestamps and attribution uncertainty."}],"detection":{"key":"enterprise/T1683","id":"T1683","name":"Generate Content","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1683","technique_page":"techniques/enterprise/T1683/","page":"detections/enterprise/T1683/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0916","name":"Detection of Generate Content","url":"https://attack.mitre.org/detectionstrategies/DET0916","stix_id":"x-mitre-detection-strategy--732ae9e0-1ff8-40bf-bc13-ea3a0bb6fee0","relationship_id":"relationship--68b1bd9b-5d0c-426f-b510-e323ab629552","description":"","analytics":[{"id":"AN2059","name":"Analytic 2059","guidance":"Much of this takes place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0916#AN2059","platforms":["PRE"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-external-intelligence-context-only","name":"External intelligence (context only)","tag":"Proposed: External intelligence (context only)","page":"telemetry/proposed-external-intelligence-context-only/","kind":"proposed_input"},{"id":"proposed-provider-side-audit-if-lawfully-available","name":"Provider-side audit (if lawfully available)","tag":"Proposed: Provider-side audit (if lawfully available)","page":"telemetry/proposed-provider-side-audit-if-lawfully-available/","kind":"proposed_input"}],"visibility":"outside_target_visibility","visibility_note":"The upstream guidance describes limited target visibility. These are conditional investigation inputs, not direct victim-side detection of preparation. Simulator-side logs do not prove defender visibility.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) has created a skills file titled `AI LATERAL_SUGGESTIONS.md` that included tables mapped with harvested credentials with potential victim internal servers.(Citation: AI-Mexico-Govt-Breach) ","relationship_id":"relationship--a655fae1-bf08-4e5a-8d83-484032f1068a","references":[{"source_name":"AI-Mexico-Govt-Breach","description":"Eyal Sela. (2026, April). The AI-Assisted Breach of Mexico's Government Infrastructure. Retrieved September 2, 2026.","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}]}],"actors":[],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on designing defenses that are not reliant on atomic indicators. ","relationship_id":"relationship--29583c11-3bef-41aa-b791-9b5a2bf6d291","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1684":"/ttp-simulation/techniques/enterprise/T1684/","T1682":"/ttp-simulation/techniques/enterprise/T1682/","T1588.007":"/ttp-simulation/techniques/enterprise/T1588.007/","T1566":"/ttp-simulation/techniques/enterprise/T1566/","T1598":"/ttp-simulation/techniques/enterprise/T1598/","T1657":"/ttp-simulation/techniques/enterprise/T1657/","T1585":"/ttp-simulation/techniques/enterprise/T1585/","T1587":"/ttp-simulation/techniques/enterprise/T1587/","T1683":"/ttp-simulation/techniques/enterprise/T1683/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1683","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-external-intelligence-context-only","collector":"illustrative-lab-collector","observation":{"indicator":"lab.example.test","source_record":"lab-feed-1","confidence":"context_only","victim_access_observed":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-provider-side-audit-if-lawfully-available","collector":"illustrative-lab-collector","observation":{"provider_record_id":"lab-disclosure-1","access_basis":"authorized_test_account_export","action":"account_created","victim_network_observation":false}}]}}