Applied Cybernetics Group
T1587 Develop Capabilities
- Technique
T1587- Tactics
- Resource Development
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 6
- Elastic, Splunk
- 1
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1587
MITRE description
Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020) As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. Adversaries may also employ the use of [Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007) for development.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- CVE-2021-1675 Print Spooler Exploitation Filename Pattern (emerging-threats)
- Suspicious Word Cab File Write CVE-2021-40444 (emerging-threats)
- FoggyWeb Backdoor DLL Loading (emerging-threats)
- Program Executions in Suspicious Folders (core)
- Linux HackTool Execution (core)
- HackTool - PurpleSharp Execution (core)