T1583.004 Server | thrunt.me

Technique: T1583.004
Tactics: Resource Development
Research, 90 days: 2
KEV CVEs mapped: 0
SigmaHQ rules: 0
Elastic, Splunk: 0
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1583/004

MITRE description

Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked) Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-21 Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

Coverage data unavailable in this snapshot (community inventory not yet ingested).

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.