Develop Capabilities: recognize the technique

Lesson Purpose

What you are learning

This technique is about creating resources that may support later operations. ATT&CK includes items such as software, exploits, certificates, or other capabilities. This lesson focuses on what defenders may observe and how they can reduce exposure, not on building offensive tools. Defenders should use context and evidence to decide whether the behavior is relevant to their organization.

Learning Objectives

Explain Develop Capabilities in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Capability development may happen outside the target network, so defenders may see little until the capability is staged or used. External intelligence can still help when it is compared with the organization's actual technology and exposure. Defenders get the clearest picture when outside reports are compared with the software and systems their organization actually uses.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Defenders learn about new capabilities through vendor/research reports, vulnerability intelligence, threat intelligence, and internal detection or testing evidence.
Avoid over-attribution by asking whether the capability actually applies to your technology and whether there is evidence connecting it to observed activity.
Reduce risk through patching, exposure reduction, detection engineering, application controls, and prioritizing controls for capabilities relevant to your environment.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three sources that could inform defenders about new capabilities. Then give one question that avoids over-attribution and two controls that reduce risk if the capability becomes relevant. Do not build or obtain offensive capabilities.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Develop Capabilities? This technique is about creating resources that may support later operations. This technique is about getting capabilities from another source instead of creating them. This technique is about preparing content, tools, or other resources on infrastructure so they are ready for later use.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Threat-intelligence reports, malware analysis, vulnerability reports, certificate records, and endpoint detections Threat-intelligence reports, vulnerability advisories, malware analysis, endpoint detections, and delivery or execution logs Web-content changes, certificate and DNS changes, proxy and DNS logs, download records, and endpoint events

3. Which interpretation best avoids overstating what the observed information proves? Capability development may be hard to see directly. Combine outside intelligence with internal exposure and activity. Availability of an offensive capability does not prove compromise. Combine capability information with organizational exposure and observed activity. Staging is preparation. Strong conclusions come from connecting infrastructure changes with later contact or system activity.

4. Consider this behavior: This technique is about creating resources that may support later operations. ATT&CK includes items such as software, exploits, certificates, or other capabilities. Which ATT&CK technique best matches the behavior? Develop Capabilities Obtain Capabilities Stage Capabilities

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Check whether the capability applies to technology the organization actually uses, then prioritize relevant protections Check whether the capability applies to organizational systems and whether there is evidence of delivery or use Connect infrastructure changes with enterprise contact and later endpoint or network activity

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? Evidence that a capability exists is not the same as evidence that it targets the organization The existence of an offensive tool or exploit does not prove that the organization is compromised A hosted file, redirect, or new service is not automatically malicious

Learning Moment

Capability development may be hard to see directly. Combine outside intelligence with internal exposure and activity.

Defender Perspective

Useful sources include threat-intelligence reports, malware analysis, vulnerability and exploit reports, certificate records, software-repository monitoring, and later endpoint or network detections. Separate evidence that a capability exists from evidence that it targets the organization. Reduce risk with patching, endpoint protection, application control, secure software practices, and prioritized remediation.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard