Complete technique description
Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.[TrendmicroHideoutsLease] Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.[Free Trial PurpleUrchin] Additionally, botnets are available for rent or purchase.
Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support Proxy, including from residential proxy services.[amnesty_nso_pegasus][FBI Proxies Credential Stuffing][Mandiant APT29 Microsoft 365 2022] Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.
Official technique definition · Open in the interactive matrix
Parent and sub-techniques
Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.
Detection telemetry and configuration
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
Active DNS · source-mapped
DC0103 collection page — Record authorized query name/type, resolver, request time, response code and returned records. Keep active-query results separate from evidence that a victim made the same query.
Providers and collection configuration
- ISC BIND dig: Explicit DNS lookups against a selected resolver; output contains answer and query context.
- Zeek DNS logs: Passive corroboration when the active query crosses an authorized visible sensor.
- Select the owned lab resolver, allowed query names and record types. Use bounded queries, not unrestricted enumeration.
- Retain full answer sections, response codes, TTLs, resolver address and query/collection timestamps; record cache and split-DNS context.
- Store current resolutions separately from passive historical observations. Repeat only at an approved interval and record changes without inferring ownership.
Required normalized fields: query, rrtype, resolver, answer, response_code.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0103",
"collector": "illustrative-lab-collector",
"observation": {
"query": "lab.example.test",
"rrtype": "A",
"resolver": "192.0.2.53",
"answer": "192.0.2.20",
"response_code": "NOERROR"
}
}
Visibility limits: A resolution result is time- and resolver-dependent. Active queries generated by an analyst do not prove a target or adversary made those queries.
Domain Registration · source-mapped
DC0101 collection page — Query an approved RDAP service/feed, retaining retrieval time and registration-event dates; preserve redaction and missing-field indicators.
Providers and collection configuration
- Use an approved feed/API or documented lawful export. Store retrieval time, source URL, original record ID, observation time and confidence separately.
- Retain the raw response, licensing constraints and analyst assessment. Deduplicate observations without erasing independent provenance.
- Correlate external context with authorized internal observations; do not label ownership, attribution or compromise from a shared indicator alone.
Required normalized fields: domain, event, registrant, retrieved_at.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0101",
"collector": "illustrative-lab-collector",
"observation": {
"domain": "example.test",
"event": "registration",
"registrant": "redacted",
"retrieved_at": "2026-09-27T12:00:00Z"
}
}
Visibility limits: Coverage, licensing, redaction and reporting delays vary. External context is not proof of access to the target, and cannot substitute for unavailable provider-side audit.
Passive DNS · source-mapped
DC0096 collection page — Collect permitted DNS observations with RR type, answer, first/last seen and sensor/source; distinguish local sensor history from a broader intelligence feed.
Providers and collection configuration
- Zeek: Connection and protocol metadata from traffic visible to the sensor.
- Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
- Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
- Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
- Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.
Required normalized fields: query, rrtype, answer, first_seen, last_seen.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0096",
"collector": "illustrative-lab-collector",
"observation": {
"query": "lab.example.test",
"rrtype": "A",
"answer": "192.0.2.20",
"first_seen": "2026-09-27T11:00:00Z",
"last_seen": "2026-09-27T12:00:00Z"
}
}
Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
Response Content · source-mapped
DC0104 collection page — Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.
Providers and collection configuration
- Zeek: Connection and protocol metadata from traffic visible to the sensor.
- Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
- Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
- Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
- Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.
Required normalized fields: service, response_excerpt, content_type, body_truncated.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0104",
"collector": "illustrative-lab-collector",
"observation": {
"service": "https://lab.example.test/health",
"response_excerpt": "LAB_OK",
"content_type": "text/plain",
"body_truncated": false
}
}
Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
Response Metadata · source-mapped
DC0106 collection page — Preserve target, observation time, scan method and response evidence; distinguish inferred service identity from an authenticated software inventory.
Providers and collection configuration
- Nmap XML reports: Structured port/service observations from a separately authorized scan or existing report.
- Zeek protocol observations: Passive corroboration for visible service responses; not equivalent to active scan coverage.
- Use an existing authorized scan report or an explicitly approved isolated target set. Record tool/version, scan options, time window and scope.
- Preserve native XML and normalized host/port/protocol/service fields. Disable XML external-entity resolution in downstream parsers.
- Keep inferred service names/versions and their confidence separate from authenticated inventory; retain response evidence when available.
Required normalized fields: target, port, transport, service, version, observation_source.
Illustrative collection event
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0106",
"collector": "illustrative-lab-collector",
"observation": {
"target": "192.0.2.20",
"port": 443,
"transport": "tcp",
"service": "https",
"version": "not_identified",
"observation_source": "authorized_lab_scan"
}
}
Visibility limits: A reported open port or banner is not a proven vulnerability. Filtered/no-response states can reflect routing or policy. The website performs no scans.