Acquire Infrastructure: recognize the technique

Lesson Purpose

What you are learning

This technique is about obtaining infrastructure that can support later activity. Examples include domains, hosted servers, virtual private servers, DNS services, web services, or serverless resources. A new domain or rented server is not automatically malicious. Defenders should look for relationships between the infrastructure, enterprise activity, and other signs of suspicious behavior.

Learning Objectives

Explain Acquire Infrastructure in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Infrastructure may be visible through registration, DNS, hosting, certificates, or network activity before it directly contacts an organization. One signal alone is usually weak, so defenders should look for relationships and context. This context helps defenders separate normal new infrastructure from activity that deserves more review.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Evidence about unfamiliar infrastructure can come from DNS, registration/hosting information, certificates, network telemetry, and threat-intelligence reporting.
Infrastructure becomes more suspicious when multiple relationships connect it to relevant malicious or unexpected activity; one new domain or server alone is weak evidence.
Reduce exposure with DNS/web filtering, egress controls, monitoring, and keeping externally exposed services patched and minimized.

This is ungraded practice. Use the lesson material above; exact wording is not required. List three evidence sources that could help assess unfamiliar infrastructure. Then describe one relationship that would make it more suspicious and two controls that reduce exposure. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Acquire Infrastructure? This technique is about obtaining infrastructure that can support later activity. This technique is about taking control of infrastructure that belongs to someone else and using it later. This technique is about creating accounts or personas that can support later activity.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? DNS history, domain-registration data, certificate records, proxy logs, and approved infrastructure inventories Unexpected configuration changes, new admin logins, certificate or DNS changes, provider alerts, and unusual connections Brand-impersonation reports, email-security events, account metadata, suspicious links, and provider abuse reports

3. Which interpretation best avoids overstating what the observed information proves? Judge infrastructure by its relationships and behavior, not simply because it is new. Trusted history is not enough. Current behavior and change evidence matter. A new account alone is weak evidence. Behavior, identity claims, and connections provide stronger context.

4. Consider this behavior: This technique is about obtaining infrastructure that can support later activity. Examples include domains, hosted servers, virtual private servers, DNS services, web services, or serverless resources. Which ATT&CK technique best matches the behavior? Acquire Infrastructure Compromise Infrastructure Establish Accounts

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Check ownership, relationships, and enterprise contact before deciding whether unfamiliar infrastructure is suspicious Review recent administrative and configuration changes and use MFA, patching, and change monitoring Check what the account claims to represent and how it interacts with employees or customers

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? A new domain, certificate, or cloud host is not malicious simply because it is new A legitimate owner or good past reputation does not guarantee that infrastructure is safe now An account should not be treated as malicious only because it is new

Learning Moment

Judge infrastructure by its relationships and behavior, not simply because it is new. Defenders should confirm the context with more than one source before deciding that the activity is suspicious.

Defender Perspective

Useful evidence includes DNS history, domain-registration data, certificate records, IP and hosting context, proxy and DNS logs, threat intelligence, brand monitoring, and inventories of approved company infrastructure. Check whether a domain or host is expected, who controls it, what it connects to, and whether company systems contacted it. Reduce risk with DNS and web filtering, egress monitoring, brand monitoring, and accurate infrastructure inventories.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard