Acquire Infrastructure `T1583`

Tactic: Resource Development

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services. Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost. Additionally, botnets are available for rent or purchase.

Authoring guide

These 8 rules share fields, values, and exclusions.

Fields filtered most (14 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	5	`eq` 4, `in` 1	`AssociateVPCWithHostedZone`, `DeleteIdentity`, `IntrusionEvent`, `RequestServiceQuotaIncrease`, `VerifyDomainDkim`
`Provider_Name`	3	`eq` 3	`route53.amazonaws.com`, `servicequotas.amazonaws.com`, `ses.amazonaws.com`
`data_stream.dataset`	3	`eq` 3	`aws.cloudtrail`
`event.outcome`	3	`eq` 3	`success`
`Esql.ses_delete_count`	1	`gt` 1	`0`
`Esql.ses_verify_count`	1	`gt` 1	`0`
`Esql.ses_verify_timestamp_min`	1	`lt` 1	`Esql.ses_delete_timestamp_max`
`TriggerCount`	1	`eq` 1	`1`
`aws::errorCode`	1	`eq` 1	`Client.UnauthorizedOperation`
`aws::eventName`	1	`eq` 1	`RunInstances`
`aws::userIdentity.arn`	1	`is_not_null` 1
`domainAge`	1	`ge` 1, `lt` 1	`0`, `7`
`event.dataset`	1	`eq` 1	`github.audit`
`sourcetype`	1	`eq` 1	`cisco:sfw:estreamer`

Top indicator values (27 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS Service Quota Increase Requested by Rare Identity	2	143
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS SES Email Identity Verified Then Deleted	1	40
`event.outcome`	`eq`	`success` elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS Service Quota Increase Requested by Rare Identity	2	306
`event.outcome`	`eq`	`success` elasticAWS SES Email Identity Verified Then Deleted	1	82
`Esql.ses_delete_count`	`gt`	`0` elasticAWS SES Email Identity Verified Then Deleted	1
`Esql.ses_verify_count`	`gt`	`0` elasticAWS SES Email Identity Verified Then Deleted	1
`Esql.ses_verify_timestamp_min`	`lt`	`Esql.ses_delete_timestamp_max` elasticAWS SES Email Identity Verified Then Deleted	1
`EventType`	`eq`	`AssociateVPCWithHostedZone` elasticAWS Route 53 Private Hosted Zone Associated With a VPC	1
`EventType`	`eq`	`IntrusionEvent` splunkCisco Secure Firewall - Rare Snort Rule Triggered	1	18
`EventType`	`eq`	`RequestServiceQuotaIncrease` elasticAWS Service Quota Increase Requested by Rare Identity	1
`EventType`	`eq`	`repo.create` elasticGitHub Repo Created	1
`EventType`	`in`	`DeleteIdentity` elasticAWS SES Email Identity Verified Then Deleted	1
`EventType`	`in`	`VerifyDomainDkim` elasticAWS SES Email Identity Verified Then Deleted	1
`EventType`	`in`	`VerifyDomainIdentity` elasticAWS SES Email Identity Verified Then Deleted	1
`EventType`	`in`	`VerifyEmailAddress` elasticAWS SES Email Identity Verified Then Deleted	1
`EventType`	`in`	`VerifyEmailIdentity` elasticAWS SES Email Identity Verified Then Deleted	1
`Provider_Name`	`eq`	`route53.amazonaws.com` elasticAWS Route 53 Private Hosted Zone Associated With a VPC	1
`Provider_Name`	`eq`	`servicequotas.amazonaws.com` elasticAWS Service Quota Increase Requested by Rare Identity	1
`Provider_Name`	`eq`	`ses.amazonaws.com` elasticAWS SES Email Identity Verified Then Deleted	1
`TriggerCount`	`eq`	`1` splunkCisco Secure Firewall - Rare Snort Rule Triggered	1
`aws::errorCode`	`eq`	`Client.UnauthorizedOperation` kustoAWSCloudTrail - Unauthorized EC2 Instance Setup Attempt	1
`aws::eventName`	`eq`	`RunInstances` kustoAWSCloudTrail - Unauthorized EC2 Instance Setup Attempt	1	2
`aws::userIdentity.arn`	`is_not_null`	elasticAWS SES Email Identity Verified Then Deleted	1	10
`domainAge`	`ge`	`0` kustoWhisper Security - Newly Registered Domain on Threat ASN	1
`domainAge`	`lt`	`7` kustoWhisper Security - Newly Registered Domain on Threat ASN	1
`event.dataset`	`eq`	`github.audit` elasticGitHub Repo Created	1	5
`sourcetype`	`eq`	`cisco:sfw:estreamer` splunkCisco Secure Firewall - Rare Snort Rule Triggered	1	32

Exclusions (4 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`Pulumi` elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS Service Quota Increase Requested by Rare Identity	2
`aws::userAgent`	`contains`	`Terraform` elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS Service Quota Increase Requested by Rare Identity	2
`aws::userAgent`	`contains`	`Ansible` elasticAWS Service Quota Increase Requested by Rare Identity	1
`aws::userAgent`	`eq`	`cloudformation.amazonaws.com` elasticAWS Service Quota Increase Requested by Rare Identity	1

Acquire Infrastructure `T1583`

Authoring guide

Fields filtered most (14 distinct)

Top indicator values (27 distinct)

Exclusions (4 distinct)

Rules under this technique

Elastic 4 rules

Splunk 1 rule

Kusto 3 rules

Acquire Infrastructure T1583

Authoring guide

Fields filtered most (14 distinct)

Top indicator values (27 distinct)

Exclusions (4 distinct)

Rules under this technique

Elastic 4 rules

Splunk 1 rule

Kusto 3 rules

Acquire Infrastructure `T1583`