Acquire Access: recognize the technique

Lesson Purpose

What you are learning

Acquire Access means getting access that already exists, such as an account or remote-access connection, instead of creating a new way into the target. A successful login does not always mean the person logging in is the legitimate user. Defenders should look at where the login came from, which device was used, whether MFA changed, and what happened after the login.

Learning Objectives

Explain Acquire Access in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Organizations often watch failed logins and exploit attempts, but misuse of valid credentials can look normal at first. Defenders should compare a login with the user's usual devices, locations, times, MFA history, and follow-on activity. Looking at several signals together helps avoid treating one unusual login as proof of malicious activity.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

After a suspicious successful login, review authentication logs, device/session information, MFA history, network/location context, and follow-on account activity.
Ask whether the device, location, time, MFA behavior, and subsequent actions are consistent with the legitimate user's normal activity.
Controls include MFA, conditional access, session monitoring, credential protection, and rapid revocation of suspicious sessions.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three evidence sources a defender could review after a suspicious successful login. Then give one question that helps separate normal from suspicious access and two controls that reduce risk. No external target interaction is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Acquire Access? Acquire Access means getting access that already exists, such as an account or remote-access connection, instead of creating a new way into the target. This technique is about creating written, visual, audio, or other material that can support later targeting, impersonation, social engineering, or fraud. This technique is about obtaining infrastructure that can support later activity.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Login logs, VPN records, new-device events, MFA changes, password resets, and activity after login Email headers, sender-authentication results, link destinations, attachment metadata, and recipient reports DNS history, domain-registration data, certificate records, proxy logs, and approved infrastructure inventories

3. Which interpretation best avoids overstating what the observed information proves? Valid credentials do not always mean valid use. Check the context around a successful login. Convincing content is not automatically authentic. Use independent verification and technical evidence. Judge infrastructure by its relationships and behavior, not simply because it is new.

4. Consider this behavior: Acquire Access means getting access that already exists, such as an account or remote-access connection, instead of creating a new way into the target. A successful login does not always mean the person logging in is the legitimate user. Which ATT&CK technique best matches the behavior? Acquire Access Generate Content Acquire Infrastructure

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Compare the login with the user's normal device, source, and behavior, then review what happened after authentication Verify the claimed sender through a separate trusted channel and inspect the message's technical context Check ownership, relationships, and enterprise contact before deciding whether unfamiliar infrastructure is suspicious

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? A successful login with valid credentials does not prove that the legitimate user performed it Polished or personalized content is not proof that it is genuine A new domain, certificate, or cloud host is not malicious simply because it is new

Learning Moment

Valid credentials do not always mean valid use. Check the context around a successful login. Defenders should confirm the context with more than one source before deciding that the activity is suspicious.

Defender Perspective

Useful evidence includes login and identity logs, VPN or remote-access logs, new-device records, unusual source networks, MFA resets, password-reset history, and endpoint activity after login. Compare the event with the user's normal behavior, verify the device and source, and review what happened next. Reduce risk with strong MFA, device trust, rapid credential revocation, least privilege, and monitoring for exposed credentials.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard