Applied Cybernetics Group
T1588 Obtain Capabilities
- Technique
T1588- Tactics
- Resource Development
- Research, 90 days
- 1
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 2
- Elastic, Splunk
- 1
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1588
MITRE description
Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them. Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities. Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle. In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or individuals.(Citation: NationsBuying)(Citation: PegasusCitizenLab) In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries). This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.(Citation: DiginotarCompromise)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Antivirus - Relevant File Paths Alerts Signature (core)
- Relevant Anti-Virus Signature Keywords In Application Log (core)
Elastic and Splunk rules
- Anomalous Linux Compiler Activity (elastic)