Acquire Infrastructure (T1583) is how an adversary builds the domains, servers and cloud accounts they will attack from, days or weeks before a single packet reaches your network. There is no endpoint telemetry for it. Detection means watching DNS and proxy logs for newly registered or lookalike domains before anyone clicks, not chasing a process tree.
Practice detecting Acquire Infrastructure on realistic SIEM alerts in SOCSimulator Operations.
“Acquire Infrastructure is documented as technique T1583 in MITRE ATT&CK® v19.1 under the Resource Development tactic. Detection requires visibility into SIEM telemetry.”
The most common form is domains: an operator bulk-registers names through registrars like Namecheap or NameSilo, pays with a stolen or prepaid card, hides the owner behind WHOIS privacy, and often registers a cluster of related names on the same day so one campaign can rotate through several before defenders block the first. A DNS server acquired alongside the domain lets the attacker control resolution directly, useful for fast-flux setups where the IP behind a domain changes every few minutes to dodge blocklists.
Servers, virtual private servers and botnets cover the compute side. Bulletproof hosting providers rent space with no abuse response, but plenty of operators instead abuse mainstream cloud accounts on AWS, Azure or DigitalOcean using stolen credit cards or compromised customer accounts, because traffic to a major cloud ASN blends in far better than traffic to a known-bad hosting block. Botnets are simply rented by the hour or day on criminal marketplaces, giving an attacker thousands of residential IPs to route credential-stuffing or C2 traffic through.
Web services, serverless platforms and malvertising are the newest and hardest to catch, because the infrastructure is legitimate and free. Adversaries stage phishing chains on services like webhook.site and image-hosting platforms, both real services defenders rarely block wholesale. Cloudflare Workers, Firebase Hosting and Discord's CDN get the same treatment for the same reason: the domain itself carries no reputation risk. Malvertising buys ad placements on real ad exchanges to redirect victims through a chain that ends on attacker-acquired infrastructure, all without registering a single suspicious domain up front.
Resource Development sits before the first contact with a victim. An operator has already picked a target or a target profile during reconnaissance, and acquiring infrastructure is the last preparation step before Initial Access, most often Phishing (T1566) or a drive-by redirect. A common example is a lookalike domain that mimics a target's real SSO or IT helpdesk portal, registered days ahead of a vishing call so the domain is ready and warmed up the moment the social-engineering call convinces a helpdesk agent to reset a password.
The other pattern skips domain registration entirely: operators acquire accounts on legitimate web services (webhook.site for a lure page, an image host for a decoy) specifically because those platforms already have clean reputations and existing DNS trust. Once infrastructure is live, it typically feeds straight into Compromise Infrastructure (T1584) hardening or Stage Capabilities (T1608), where the payload actually gets uploaded, before the first phishing email or malicious ad ever goes out. The acquisition step is invisible to endpoint tooling by design; it happens entirely outside the victim's network, which is exactly why DNS and proxy logs, not process telemetry, are where a defender gets a shot at it.
The following detection strategies help SOC analysts identify Acquire Infrastructure activity. These methods apply across SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
tag=web url=* OR sourcetype=proxy
| eval list="mozilla"
| `ut_parse_extended(url, list)`
| eval company_domain="yourcompany.com"
| `ut_levenshtein(ut_domain, company_domain)`
| where ut_levenshtein>0 AND ut_levenshtein<=2
| table _time, src_ip, ut_domain, ut_levenshteinAdapted from Splunk's URL Toolbox typosquatting detection: scores every external domain against your real domain with Levenshtein distance and surfaces anything within 1-2 edits, the threshold Splunk's own writeup calls the practical cutoff before false positives climb.
tag=web url=* earliest=-15m
| eval list="mozilla"
| `ut_parse_extended(url,list)`
| stats earliest(_time) as earliest by ut_domain
| inputlookup append=t previously_seen_domains.csv
| stats min(earliest) as earliest by ut_domain
| outputlookup previously_seen_domains.csv
| where earliest>=relative_time(now(), "-1d@d")Mirrors Splunk's operationalized 'Finding New Evil' first-seen-domain pattern: a running lookup cache of every domain ever observed, re-run on each interval, so only domains that genuinely appeared for the first time in the last 24 hours survive the filter.
_time: 2026-07-16 09:02:14
sourcetype: proxy
src_ip: 10.44.12.87
user: j.alvarez
url: https://velora-miss10n.org/login
ut_domain: velora-miss10n.org
ut_levenshtein: 1
whois_created: 2026-07-14T02:11:00Z
category: uncategorizedNewly registered domains are not inherently suspicious. Businesses launch marketing microsites, rebrand, or spin up SaaS trial subdomains constantly, and ad-tech and analytics platforms generate high-entropy tracking subdomains by design, so a raw Shannon-entropy or first-seen-domain feed will flag hundreds of benign hits a day in any mid-size environment. Employees signing up for a new vendor trial or a conference registration site will also trip an NRD rule the same day it fires.
The fix is corroboration, not a looser threshold. Allow-list known ad-tech, CDN and SaaS ranges so their routine churn stops competing with real signal, and treat a bare NRD or Levenshtein hit as a low-confidence enrichment item that only escalates when paired with a second signal: a credential POST to the domain, an inbound email referencing it, or a match against a live threat-intel indicator. A domain that is new and close to your brand name but never receives a second touch from a user is very likely someone else's trademark dispute, not your incident.
These realistic alert examples show what Acquire Infrastructure looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
WS-FIN-22 resolved secure-office365-verify.com, a domain whose WHOIS creation timestamp is 41 hours before the query. No prior traffic to this domain exists anywhere in the proxy corpus. On its own this is enrichment, not a verdict, but it queues the domain for the next 24 hours of correlation.
ut_levenshtein scoring against the corporate domain velora-mission.org returned a distance of 1 for velora-miss10n.org, queried twice from the finance segment in the last hour. A single-character substitution this close to a real corporate domain is the classic footprint of infrastructure staged for a credential-harvesting page.
DNS logs show xk29fzqp.duckdns.org queried from a single workstation, Shannon entropy 3.9 against a baseline of under 3.0 for normal browsing traffic. Combined with a dynamic-DNS parent zone, the naming pattern matches infrastructure commonly rented for low-cost C2 rather than any business domain in use.
When a lookalike or newly-registered-domain alert fires, start with whether a human actually touched it: did the connection follow a click in an email, or was it an automated background request from ad-tech or a security scanner? Pull the domain's registrar, WHOIS creation date, hosting ASN and any TLS certificate details, and compare the string against your real brand and any known partner domains to rule out a legitimate rebrand or acquisition.
If a user submitted credentials, clicked through to a login-style page, or the domain matches a live threat-intel indicator, escalate immediately: force a password reset for the affected account, block the domain at DNS and proxy, and hunt for any other host in the environment that queried the same domain in the same window. If no user interaction occurred, log the domain to your watchlist and revisit if it resurfaces, since most acquired infrastructure that never gets touched was staged for a target other than you or abandoned before use.
Investigate Acquire Infrastructure on realistic SIEM, XDR, and firewall consoles, free.
Investigate an adversary-in-the-middle (AiTM) credential phishing campaign that lured an employee to a lookalike Microsoft 365 login page. Working entirely from SIEM logs, you will identify the lookalike domain, reconstruct the multi-hop redirect chain through a compromised legitimate site, uncover a secondary phishing wave against another employee, and confirm account takeover in Azure AD sign-in logs via impossible travel and session-token replay. You finish by choosing the containment action that actually evicts an attacker holding a valid session token. Foundational skills for SOC analysts in lookalike-domain analysis and identity-centric incident response.
A diplomatic attache clicked a link offering a discounted vehicle for sale, and a trusted Windows program started behaving like malware. Follow the chain from a spearphishing link through an abused web-service redirector and a staged archive to a side-loaded HeadLace loader running under a legitimate signed binary.
Threat intelligence is analyzed, contextualized information about current and emerging cyber threats, including threat a…
Read more GlossaryA threat actor is any individual, group, or organization that conducts or sponsors malicious cyber activity, spanning na…
Read more GlossaryAn Advanced Persistent Threat (APT) is a sophisticated, often nation-state-sponsored threat actor conducting long-durati…
Read more GlossaryAn Indicator of Compromise (IOC) is an observable artifact, such as a file hash, IP address, domain name, URL, registry …
Read more Career PathThreat Hunters do not wait for alerts. You develop hypotheses based on threat intelligence and adversary behavior models…
Read more Career PathDetection Engineers build the rules, analytics, and automated workflows that determine what the SOC can see. You transla…
Read more ToolThe SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureStructured CTF-style investigation operations covering real-world attack scenarios.
Read more BlogArticles on SOC analyst skills, detection engineering, and career development.
Read more