Develop Capabilities T1587
Tactic: Resource Development
Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.
Events covered
6 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 7 | Image loaded |
| Sysmon | Event ID 11 | FileCreate |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Linux-Auditd | Event ID 1300 | SYSCALL |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 24 rules share fields, values, and exclusions.
Fields filtered most (19 distinct)
These fields appear most often in rule filters.
Top indicator values (479 distinct)
These values appear most often in rule predicates.
Exclusions (80 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 17 rules
- Conti Volume Shadow Listing
- Creation of an Executable by an Executable
- CVE-2021-1675 Print Spooler Exploitation Filename Pattern
- FoggyWeb Backdoor DLL Loading
- Formbook Process Creation
- HackTool - PurpleSharp Execution
- Linux HackTool Execution
- Mustang Panda Dropper
- Potential Privilege Escalation To LOCAL SYSTEM
- Potential PsExec Remote Execution
- Program Executions in Suspicious Folders
- ProxyLogon MSExchange OabVirtualDirectory
- PsExec/PAExec Escalation to LOCAL SYSTEM
- PUA - CsExec Execution
- Suspicious Word Cab File Write CVE-2021-40444
- Uncommon File Created In Office Startup Folder
- VHD Image Download Via Browser
Elastic 1 rule
Splunk 3 rules
- Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint
- Cisco Secure Firewall - Possibly Compromised Host
- Windows Certutil Root Certificate Addition