Compromise Infrastructure: Server
- ID
- T1584.004
- Tactics
- TA0042 Resource Development
- Sub-technique of
- T1584 Compromise Infrastructure
- Platforms
- PRE
- Data sources
- Response Content, Response Metadata
- Source
- attack.mitre.org
- MITRE last modified
- 18 Sep 2026
Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.[1] Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations.
Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise, or email servers to support Phishing operations.
Detection
- DET0874 Detection of Server
Data components: Response Content, Response Metadata
Mitigations (1)
- M1056 Pre-compromise
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.
Groups (10)
- G0010 Turla
- G0023 APT16
- G0032 Lazarus Group
- G0034 Sandworm Team
- G0035 Dragonfly
- G0065 Leviathan
- G0119 Indrik Spider
- G1006 Earth Lusca
- G1017 Volt Typhoon
- G1034 Daggerfly