Compromise Infrastructure: recognize the technique

Lesson Purpose

What you are learning

This technique is about taking control of infrastructure that belongs to someone else and using it later. A previously trusted website, server, or cloud resource can become unsafe after it is compromised. The key clue is a change in control or behavior, not simply the age or reputation of the system.

Learning Objectives

Explain Compromise Infrastructure in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Old reputation or a legitimate owner does not guarantee that a system is still trustworthy. Defenders should look for recent changes in behavior, configuration, and administration. A familiar domain or server can still become risky if its control, configuration, or behavior changes.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Possible compromise signs include unexpected administrative/configuration changes, new or unusual content, redirects or services, and behavior that differs from the system's established history.
Investigate by comparing current behavior/configuration with known-good records and reviewing relevant authentication, change, network, and endpoint evidence.
Controls include MFA and privileged-access protection, patching, monitoring/change detection, backups, and limiting administrative exposure.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three signs that previously legitimate infrastructure may have been compromised. Then name one investigation step and two controls that reduce the chance or impact of compromise. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Compromise Infrastructure? This technique is about taking control of infrastructure that belongs to someone else and using it later. This technique is about creating accounts or personas that can support later activity. This technique is about taking control of an existing account for later use.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Unexpected configuration changes, new admin logins, certificate or DNS changes, provider alerts, and unusual connections Brand-impersonation reports, email-security events, account metadata, suspicious links, and provider abuse reports Unusual logins, new devices, MFA resets, changed recovery details, new tokens, and unexpected account actions

3. Which interpretation best avoids overstating what the observed information proves? Trusted history is not enough. Current behavior and change evidence matter. A new account alone is weak evidence. Behavior, identity claims, and connections provide stronger context. For an established account, changes in authentication, settings, or behavior can be stronger clues than the account name itself.

4. Consider this behavior: This technique is about taking control of infrastructure that belongs to someone else and using it later. A previously trusted website, server, or cloud resource can become unsafe after it is compromised. Which ATT&CK technique best matches the behavior? Compromise Infrastructure Establish Accounts Compromise Accounts

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Review recent administrative and configuration changes and use MFA, patching, and change monitoring Check what the account claims to represent and how it interacts with employees or customers Review authentication history and security-setting changes, then revoke suspicious sessions or tokens

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? A legitimate owner or good past reputation does not guarantee that infrastructure is safe now An account should not be treated as malicious only because it is new A familiar account name does not guarantee that the legitimate owner is still in control

Learning Moment

Trusted history is not enough. Current behavior and change evidence matter. Defenders should confirm the context with more than one source before deciding that the activity is suspicious.

Defender Perspective

Useful evidence includes unexpected content or configuration changes, new admin logins, unplanned services, certificate or DNS changes, unusual outbound connections, provider alerts, and integrity-monitoring results. Check ownership, recent changes, administrator activity, and software vulnerabilities. Reduce risk with patching, MFA, least privilege, secure admin interfaces, change monitoring, backups, and recovery procedures.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard