Develop Capabilities
- ID
- T1587
- Tactics
- TA0042 Resource Development
- Platforms
- PRE
- Data sources
- Malware Content, Malware Metadata, Response Content
- Source
- attack.mitre.org
- MITRE last modified
- 19 Sep 2026
Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.[1][2][3][4]
As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability. Adversaries may also employ the use of Artificial Intelligence for development.
Sub-techniques (4)
- T1587.001 Malware
- T1587.002 Code Signing Certificates
- T1587.003 Digital Certificates
- T1587.004 Exploits
Detection
- DET0853 Detection of Develop Capabilities
Data components: Malware Content, Malware Metadata, Response Content
Mitigations (1)
- M1056 Pre-compromise
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.