# T1583 - Acquire Infrastructure

## SOC Recommendation
Investigate Acquire Infrastructure activity in the context of Resource Development: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Add lookalike domain to MDO blocked senders list proactively | Medium | No | Yes |
| Add to Sentinel TI watchlist for ongoing monitoring | Low | No | Yes |
| Consider domain takedown request via NCSC or registrar abuse | Low | No | Yes |
| Alert employees to watch for phishing from this domain | Low | No | Yes |

## KQL
```kql
ThreatIntelligenceIndicator
| where TimeGenerated >= ago(1d)
| where Active == true
| where Tags has_any ("lookalike", "typosquat", "phishing", "brand-abuse", "impersonation")
| where DomainName has_any (_GetWatchlist('InternalEmailDomains')
    | extend DomainKey = tostring(column_ifexists("SearchKey", column_ifexists("domain", column_ifexists("Domain", ""))))
    | where isnotempty(DomainKey)
    | project DomainKey)
    or Description has_any (_GetWatchlist('InternalEmailDomains')
    | extend DomainKey = tostring(column_ifexists("SearchKey", column_ifexists("domain", column_ifexists("Domain", ""))))
    | where isnotempty(DomainKey)
    | project DomainKey)
| project TimeGenerated, DomainName, Description, Tags, ConfidenceScore, ThreatType
| extend timestamp = TimeGenerated
| order by ConfidenceScore desc
| extend DNSCustomEntity = DomainName
```
```kql
blacklens_CL
| summarize arg_max(TimeGenerated, *) by id
| extend AlertSeverity = case(
    tolower(severity) == "critical", "High",
    tolower(severity) == "high", "High",
    tolower(severity) == "medium", "Medium",
    tolower(severity) == "low", "Low",
    "Informational"
)
```
```kql
// High severity-  Brand Intelligence - Domain Impersonation
let timeFrame = 5m;
CyfirmaBIDomainITAssetAlerts_CL
| where severity == 'Critical' and TimeGenerated between (ago(timeFrame) .. now())
| extend
    Description=description,
    FirstSeen=first_seen,
    LastSeen=last_seen,
    RiskScore=risk_score,
    AlertUID=alert_uid,
    UID=uid,
    Domain=domain,
    DRDomain=dr_domain,
    DRSubDomain=dr_sub_domain,
    DomainSquat=signature,
    HostProvider=host_provider,
    RegisteredDate=registered_date,
    CreatedDate=created_date,
    ThreatActor=suspected_threat_actor,
    ProviderName='CYFIRMA',
    ProductName='DeCYFIR/DeTCT'
| project
    TimeGenerated,
    Description,
    RiskScore,
    FirstSeen,
    LastSeen,
    AlertUID,
    UID,
    Domain,
    DRDomain,
    DRSubDomain,
    DomainSquat,
    HostProvider,
    RegisteredDate,
    CreatedDate,
    ThreatActor,
    ProductName,
    ProviderName
```

## Escalation Criteria
- Acquire Infrastructure activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.