Acquire Infrastructure: Domains T1583.001

Tactic: Resource Development

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType1eq 1associatevpcwithhostedzone
Provider_Name1eq 1route53.amazonaws.com
data_stream.dataset1eq 1aws.cloudtrail
event.outcome1eq 1success

Top indicator values (4 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypeeq
associatevpcwithhostedzone
1
Provider_Nameeq
route53.amazonaws.com
1
data_stream.dataseteq
aws.cloudtrail
1173
event.outcomeeq
success
1375

Exclusions (2 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
aws::userAgentcontains
pulumi
1
aws::userAgentcontains
terraform
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: AWS

Domain: Cloud

Elastic 1 rule