Acquire Infrastructure
Infrastructure acquisition obtains domains, servers, or other resources used to support operations.
What it means
Infrastructure acquisition obtains domains, servers, or other resources used to support operations. Ownership and timing can help investigate a campaign without proving attribution alone.
MITRE ATT&CK catalogs this behavior as T1583, within resource development. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A newly registered domain and rented server are associated with suspicious delivery or command traffic.
Evidence to examine
Review registration and hosting evidence, timestamps, resource relationships, and observed use against the organization.
A common analytical pitfall
Shared hosting and public registration data can create misleading associations between unrelated actors.
Response considerations
Use corroborated infrastructure evidence for defensive controls and report attribution uncertainty rather than treating a shared provider as proof.
Resource ownership is not the same as operational use
A fictional investigation links a newly registered domain to a rented server. Those resources may support an operation, but the analyst still needs evidence of how they were used. Registration, hosting, delivery, and command traffic are separate relationships that can change over time.
Public providers serve many unrelated customers. Sharing a hosting network or registrar is weak evidence of common control by itself. More specific overlaps, such as observed configuration relationships and coordinated timing, can strengthen a hypothesis, but should still be described with appropriate confidence. Avoid turning a provider name into an actor identity.
The timing of acquisition can help establish preparation. A resource obtained shortly before suspicious delivery may fit a campaign timeline, while a long-lived legitimate domain could have changed ownership or use. Preserve the source and observation date for every relationship. Historical records need to be interpreted in their original context.
Build a resource timeline
For a classroom exercise, create fictional domain-registration, DNS, and connection events. Mark when a resource first appears, when it becomes associated with suspicious content, and when that association ends. Add an unrelated customer on the same hosting provider and explain why the shared provider does not connect the two customers.
Defensive action should consider collateral impact. Blocking a specific corroborated malicious domain is different from blocking an entire shared service. Document the reason, scope, owner, and review date of a control. Infrastructure evidence is valuable for understanding and disrupting activity, but a useful report separates acquisition, observed use, and attribution so later analysts can reassess the conclusion as resources and ownership change.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1583: Acquire Infrastructure