Generate Content: recognize the technique

Lesson Purpose

What you are learning

This technique is about creating written, visual, audio, or other material that can support later targeting, impersonation, social engineering, or fraud. The content may look polished or personal. Defenders should verify the sender, source, links, and related activity instead of trusting appearance alone.

Learning Objectives

Explain Generate Content in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Organizations may receive convincing messages, documents, images, or audio created manually, automatically, or with AI assistance. Visual quality or good grammar alone does not prove that content is genuine. Independent verification is more reliable than judging a message only by how polished or believable it looks.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Assess suspicious content using sender/account history, message headers or source metadata, links/domains, communication history, and independent records.
Verify through an independent trusted channel rather than relying on appearance, grammar, voice, or visual quality.
Controls include independent verification procedures, filtering/detection, account protection, user awareness, and limiting sensitive actions based solely on messages.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three evidence sources that help assess suspicious content. Then give one verification step that does not rely on appearance and two controls that reduce impersonation or social-engineering risk. No content generation is required.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Generate Content? This technique is about creating written, visual, audio, or other material that can support later targeting, impersonation, social engineering, or fraud. This technique is about obtaining infrastructure that can support later activity. This technique is about taking control of infrastructure that belongs to someone else and using it later.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Email headers, sender-authentication results, link destinations, attachment metadata, and recipient reports DNS history, domain-registration data, certificate records, proxy logs, and approved infrastructure inventories Unexpected configuration changes, new admin logins, certificate or DNS changes, provider alerts, and unusual connections

3. Which interpretation best avoids overstating what the observed information proves? Convincing content is not automatically authentic. Use independent verification and technical evidence. Judge infrastructure by its relationships and behavior, not simply because it is new. Trusted history is not enough. Current behavior and change evidence matter.

4. Consider this behavior: This technique is about creating written, visual, audio, or other material that can support later targeting, impersonation, social engineering, or fraud. The content may look polished or personal. Which ATT&CK technique best matches the behavior? Generate Content Acquire Infrastructure Compromise Infrastructure

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Verify the claimed sender through a separate trusted channel and inspect the message's technical context Check ownership, relationships, and enterprise contact before deciding whether unfamiliar infrastructure is suspicious Review recent administrative and configuration changes and use MFA, patching, and change monitoring

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? Polished or personalized content is not proof that it is genuine A new domain, certificate, or cloud host is not malicious simply because it is new A legitimate owner or good past reputation does not guarantee that infrastructure is safe now

Learning Moment

Convincing content is not automatically authentic. Use independent verification and technical evidence.

Defender Perspective

Useful evidence includes email headers, sender-domain and authentication results, routing data, link destinations, attachment metadata, collaboration logs, recipient reports, and related infrastructure. Verify the claimed sender through an independent channel and compare related messages and links. Reduce risk with email authentication, secure messaging controls, user reporting, and out-of-band checks for sensitive requests.

Continue Your Learning Pathway

Next Step · Continue ATT&CK Training

Continue building your reconnaissance and resource-development foundation with the next ATT&CK lesson.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard