Acquire Infrastructure: Serverless (T1583.007)

Tactic: Resource Development · Platforms: PRE

The interactive view maps 1 detection strategy, 1 mitigation, 1 campaign to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Acquire Infrastructure (T1583).

Overview

Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.

Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to Hide Infrastructure.

Explore

• Open T1583.007 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1583.007
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan