Obtain Capabilities: recognize the technique

Lesson Purpose

What you are learning

This technique is about getting capabilities from another source instead of creating them. Examples can include tools, malware, exploits, certificates, or vulnerability information. This lesson focuses on defender recognition and risk management, not on finding, buying, downloading, or using offensive tools.

Learning Objectives

Explain Obtain Capabilities in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Available tools and newly disclosed capabilities can lower the effort needed for later attacks. Defenders should focus on capabilities that actually apply to their environment and look for evidence of delivery or use. The key question is whether the capability applies to the organization and whether there is evidence that it was delivered or used.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Evidence sources include vulnerability/advisory information, vendor or researcher reporting, threat intelligence, and internal asset/detection data.
Ask whether the obtained capability applies to software or exposure actually present in the organization and whether there is evidence of delivery or use.
Controls include patching, exposure reduction, application controls, monitoring/detection, and prioritizing relevant vulnerabilities.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three evidence sources that help a defender understand an obtained capability. Then give one question that links it to organizational exposure and two controls that reduce risk. Do not search for, purchase, download, or use offensive capabilities.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Obtain Capabilities? This technique is about getting capabilities from another source instead of creating them. This technique is about preparing content, tools, or other resources on infrastructure so they are ready for later use. Acquire Access means getting access that already exists, such as an account or remote-access connection, instead of creating a new way into the target.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Threat-intelligence reports, vulnerability advisories, malware analysis, endpoint detections, and delivery or execution logs Web-content changes, certificate and DNS changes, proxy and DNS logs, download records, and endpoint events Login logs, VPN records, new-device events, MFA changes, password resets, and activity after login

3. Which interpretation best avoids overstating what the observed information proves? Availability of an offensive capability does not prove compromise. Combine capability information with organizational exposure and observed activity. Staging is preparation. Strong conclusions come from connecting infrastructure changes with later contact or system activity. Valid credentials do not always mean valid use. Check the context around a successful login.

4. Consider this behavior: This technique is about getting capabilities from another source instead of creating them. Examples can include tools, malware, exploits, certificates, or vulnerability information. Which ATT&CK technique best matches the behavior? Obtain Capabilities Stage Capabilities Acquire Access

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Check whether the capability applies to organizational systems and whether there is evidence of delivery or use Connect infrastructure changes with enterprise contact and later endpoint or network activity Compare the login with the user's normal device, source, and behavior, then review what happened after authentication

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? The existence of an offensive tool or exploit does not prove that the organization is compromised A hosted file, redirect, or new service is not automatically malicious A successful login with valid credentials does not prove that the legitimate user performed it

Learning Moment

Availability of an offensive capability does not prove compromise. Combine capability information with organizational exposure and observed activity.

Defender Perspective

Useful sources include threat-intelligence reports, vulnerability advisories, exploit-availability reports, malware analysis, endpoint detections, certificate observations, and logs showing delivery or execution. Check whether the capability applies to technology the organization uses and whether there is evidence it was delivered or run. Reduce risk with patching, exposure reduction, endpoint and network detection, application control, and secure configuration. Risk reduction includes monitoring relevant activity and using controls that limit unnecessary exposure or access.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard