Obtain Capabilities
Capability acquisition obtains tools, exploits, or other materials from outside the operator.
What it means
Capability acquisition obtains tools, exploits, or other materials from outside the operator. Common tooling can appear across unrelated operations.
MITRE ATT&CK catalogs this behavior as T1588, within resource development. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A suspicious operation uses a publicly available tool alongside organization-specific access and configuration.
Evidence to examine
Review actual command behavior, configuration, delivery, and access context rather than identifying the product alone.
A common analytical pitfall
A tool family does not reliably identify its operator, and legitimate defenders may use the same software.
Response considerations
Focus response on unauthorized behavior and exposure and report tool identification separately from actor attribution.
Shared tools complicate attribution
A fictional incident uses a publicly available administration utility alongside a purchased malicious component. The operator obtained capabilities rather than necessarily developing every part. A recognizable tool can help explain behavior, but many unrelated actors and legitimate administrators may use the same software. Tool identity is therefore not a reliable actor identity by itself.
Focus on how the capability was acquired and used when evidence supports that distinction. Public downloads, stolen material, and commercial purchases have different provenance, but the target organization may not observe the acquisition at all. Do not infer a purchase simply because a capability is known to be sold.
The operational effect remains important. A legitimate utility can perform harmful actions when used under stolen authority. Conversely, possession of a suspicious tool does not prove every possible feature was exercised. Correlate process, account, network, and file evidence to determine the actual behavior.
Write a tool-neutral incident summary
For a classroom exercise, describe a fictional file-transfer event first without naming the utility. State which account ran it, which source and destination were involved, and what data movement was observed. Then add the tool name and explain what additional context it provides.
This order prevents the product label from replacing evidence. A report should distinguish confirmed execution, inferred purpose, and unknown acquisition history. Defensive improvements can include restricting unnecessary administrative capabilities, protecting credentials, and monitoring consequential actions. The objective is to reduce harmful use under the organization's threat model, not to assume that banning one recognizable tool eliminates an adversary's ability to obtain a different capability that performs the same task.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1588: Obtain Capabilities