# T1584 - Compromise Infrastructure

## SOC Recommendation
Investigate Compromise Infrastructure activity in the context of Resource Development: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block the TI-matched IP in Conditional Access | Medium | No | Yes |
| If sign-in was successful: treat as GEN-IA-016 (credential c | Medium | No | Yes |
| Report TI matches to your threat intelligence team for attri | Low | No | Yes |

## KQL
```kql
let TIIndicators = (
    ThreatIntelligenceIndicator
    | where Active == true and ExpirationDateTime > now()
    | where IndicatorType in ("ipv4-addr", "ipv6-addr")
    | where ConfidenceScore >= 70
    | project TI_IP = NetworkIP, ThreatType, Description, ConfidenceScore
);
SigninLogs
| where TimeGenerated >= ago(1h)
| join kind=inner TIIndicators on $left.IPAddress == $right.TI_IP
| project
    TimeGenerated, UserPrincipalName, IPAddress, ResultType, AppDisplayName,
    ThreatType, Description, ConfidenceScore
| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress
| order by ConfidenceScore desc
```
```kql
GCPAuditLogs
| where ServiceName == "dns.googleapis.com"
| where MethodName in ("dns.managedZones.update", "dns.managedZones.patch")
| where GCPResourceType == "dns_managed_zone" and Severity == "NOTICE"
| extend 
    ResponseJson = parse_json(Response),
    RequestMetadataJson = parse_json(RequestMetadata),
    AuthInfoJson = parse_json(AuthenticationInfo)
| extend ZoneContext = ResponseJson.operation.zoneContext
| where isnotempty(ZoneContext)
| extend 
    OldDnsSecState = tostring(ZoneContext.oldValue.dnssecConfig.state),
    NewDnsSecState = tostring(ZoneContext.newValue.dnssecConfig.state)
| where OldDnsSecState == "ON" and NewDnsSecState == "OFF"
| extend 
    ManagedZoneName = extract(@"managedZones/([^/]+)", 1, GCPResourceName),
    DnsName = tostring(ResponseJson.managedZone.dnsName),
    ZoneId = tostring(ResponseJson.managedZone.id),
    ZoneDescription = tostring(ResponseJson.managedZone.description),
    Visibility = tostring(ResponseJson.managedZone.visibility),
    OperationId = tostring(ResponseJson.operation.id),
    CallerIpAddress = tostring(RequestMetadataJson.callerIp),
    AuthEmail = tostring(AuthInfoJson.principalEmail)
| extend 
    AccountName = tostring(split(PrincipalEmail, "@")[0]), 
    AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
| project TimeGenerated,
          PrincipalEmail,
          AuthEmail,
          ProjectId,
          ManagedZoneName,
          DnsName,
          ResourceName = GCPResourceName,
          Visibility,
          ZoneId,
          ZoneDescription,
          OperationId,
          CallerIpAddress,
          MethodName,
          ServiceName,
          Severity,
          LogName,
          InsertId,
          AccountName,
          AccountUPNSuffix
```
```kql
// MITRE ATT&CK: T1584.001 - Compromise Infrastructure: Domains
// Tactic: Resource Development
// Detects clusters of malware-hosting domains sharing the same IP infrastructure
let minCohostedCount = 3;
let minMalwareCoHosts = 3;
let cohostedInfra = WhisperInfraContext_CL
    | where TimeGenerated > ago(1d)
    | where cohostedCount > minCohostedCount
    | extend parsedIp = tostring(split(ipAddresses, ",")[0])
    | project indicator, parsedIp, cohostedCount, countries, registrar;
let malwareIndicators = WhisperThreatIntel_CL
    | where TimeGenerated > ago(1d)
    | where isMalware == true
    | project indicator, threatScore, threatLevel, feedNames;
cohostedInfra
    | join kind=inner (malwareIndicators) on indicator
    | summarize malwareCoHostCount = dcount(indicator), DnsDomains = make_set(indicator, 10), avgThreatScore = avg(threatScore), maxThreatScore = max(threatScore) by parsedIp, cohostedCount, countries, registrar
    | where malwareCoHostCount >= minMalwareCoHosts
    | extend DnsDomain = tostring(DnsDomains[0]), IPAddress = parsedIp
    | project TimeGenerated = now(), DnsDomain, IPAddress, malwareCoHostCount, cohostedCount, avgThreatScore, maxThreatScore, countries, registrar, DnsDomains
```

## Escalation Criteria
- Compromise Infrastructure activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.