MITRE ATT&CKsub-technique

T1584.004 Server

Published 2020-10-01 Modified 2026-09-18 Official page ↗
Domain
enterprise
Tactics
Resource Development
Platforms
PRE
Version
1.2
Created
2020-10-01

Description

Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1584 Compromise Infrastructure technique

Tactic · MITRE ATT&CK (1)

  • TA0042 Resource Development tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1056 Pre-compromise mitigation

Referenced by MITRE ATT&CK · uses (16)

  • C0062 Anthropic AI-orchestrated Campaign campaign
  • C0044 Juicy Mix campaign
  • C0042 Outer Space campaign
  • G1034 Daggerfly group
  • G1017 Volt Typhoon group
  • C0022 Operation Dream Job campaign
  • C0013 Operation Sharpshooter campaign
  • C0002 Night Dragon campaign
  • G1006 Earth Lusca group
  • G0119 Indrik Spider group
  • G0065 Leviathan group
  • G0010 Turla group
  • G0023 APT16 group
  • G0032 Lazarus Group group
  • G0034 Sandworm Team group
  • G0035 Dragonfly group

References