T1584 Compromise Infrastructure
Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Suspicious External WebDAV Executionhightest · proxy
- Program Executions in Suspicious Foldersmediumtest · linux
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.