T1584 — Compromise Infrastructure

# T1584 - Compromise Infrastructure

## SOC Recommendation
Investigate Compromise Infrastructure activity in the context of Resource Development: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Network Traffic Analysis | Detect | Monitor for Network Traffic Analysis indicators relevant to this technique. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Block the TI-matched IP in Conditional Access | Medium | No | Yes |
| If sign-in was successful: treat as GEN-IA-016 (credential c | Medium | No | Yes |
| Report TI matches to your threat intelligence team for attri | Low | No | Yes |

## KQL
```kql
let TIIndicators = (
    ThreatIntelligenceIndicator
    | where Active == true and ExpirationDateTime > now()
    | where IndicatorType in ("ipv4-addr", "ipv6-addr")
    | where ConfidenceScore >= 70
    | project TI_IP = NetworkIP, ThreatType, Description, ConfidenceScore
);
SigninLogs
| where TimeGenerated >= ago(1h)
| join kind=inner TIIndicators on $left.IPAddress == $right.TI_IP
| project
    TimeGenerated, UserPrincipalName, IPAddress, ResultType, AppDisplayName,
    ThreatType, Description, ConfidenceScore
| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress
| order by ConfidenceScore desc
```
```kql
GCPAuditLogs
| where ServiceName == "dns.googleapis.com"
| where MethodName in ("dns.managedZones.update", "dns.managedZones.patch")
| where GCPResourceType == "dns_managed_zone" and Severity == "NOTICE"
| extend 
    ResponseJson = parse_json(Response),
    RequestMetadataJson = parse_json(RequestMetadata),
    AuthInfoJson = parse_json(AuthenticationInfo)
| extend ZoneContext = ResponseJson.operation.zoneContext
| where isnotempty(ZoneContext)
| extend 
    OldDnsSecState = tostring(ZoneContext.oldValue.dnssecConfig.state),
    NewDnsSecState = tostring(ZoneContext.newValue.dnssecConfig.state)
| where OldDnsSecState == "ON" and NewDnsSecState == "OFF"
| extend 
    ManagedZoneName = extract(@"managedZones/([^/]+)", 1, GCPResourceName),
    DnsName = tostring(ResponseJson.managedZone.dnsName),
    ZoneId = tostring(ResponseJson.managedZone.id),
    ZoneDescription = tostring(ResponseJson.managedZone.description),
    Visibility = tostring(ResponseJson.managedZone.visibility),
    OperationId = tostring(ResponseJson.operation.id),
    CallerIpAddress = tostring(RequestMetadataJson.callerIp),
    AuthEmail = tostring(AuthInfoJson.principalEmail)
| extend 
    AccountName = tostring(split(PrincipalEmail, "@")[0]), 
    AccountUPNSuffix = tostring(split(PrincipalEmail, "@")[1])
| project TimeGenerated,
          PrincipalEmail,
          AuthEmail,
          ProjectId,
          ManagedZoneName,
          DnsName,
          ResourceName = GCPResourceName,
          Visibility,
          ZoneId,
          ZoneDescription,
          OperationId,
          CallerIpAddress,
          MethodName,
          ServiceName,
          Severity,
          LogName,
          InsertId,
          AccountName,
          AccountUPNSuffix
```
```kql
// MITRE ATT&CK: T1584.001 - Compromise Infrastructure: Domains
// Tactic: Resource Development
// Detects clusters of malware-hosting domains sharing the same IP infrastructure
let minCohostedCount = 3;
let minMalwareCoHosts = 3;
let cohostedInfra = WhisperInfraContext_CL
    | where TimeGenerated > ago(1d)
    | where cohostedCount > minCohostedCount
    | extend parsedIp = tostring(split(ipAddresses, ",")[0])
    | project indicator, parsedIp, cohostedCount, countries, registrar;
let malwareIndicators = WhisperThreatIntel_CL
    | where TimeGenerated > ago(1d)
    | where isMalware == true
    | project indicator, threatScore, threatLevel, feedNames;
cohostedInfra
    | join kind=inner (malwareIndicators) on indicator
    | summarize malwareCoHostCount = dcount(indicator), DnsDomains = make_set(indicator, 10), avgThreatScore = avg(threatScore), maxThreatScore = max(threatScore) by parsedIp, cohostedCount, countries, registrar
    | where malwareCoHostCount >= minMalwareCoHosts
    | extend DnsDomain = tostring(DnsDomains[0]), IPAddress = parsedIp
    | project TimeGenerated = now(), DnsDomain, IPAddress, malwareCoHostCount, cohostedCount, avgThreatScore, maxThreatScore, countries, registrar, DnsDomains
```

## Escalation Criteria
- Compromise Infrastructure activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1584.json
• /api/recommendations/T1584.json
• /api/d3fend/T1584.json
• /api/mappings/T1584.json
• /api/confluence/T1584.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1584.json

Response:

{
  "technique_id": "T1584",
  "name": "Compromise Infrastructure",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Resource Development"
  ],
  "platforms": [
    "PRE"
  ],
  "summary": "Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, network devices, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle. Additionally, adversaries may compromise numerous machines to form a botnet they can leverage...",
  "soc_recommendation": "Investigate Compromise Infrastructure activity in the context of Resource Development: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-NTA",
      "name": "Network Traffic Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for Network Traffic Analysis indicators relevant to this technique.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed compromise infrastructure activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Compromised Infrastructure Used Against Tenant\" -- Flags sign-in attempts from IPs flagged in threat intelligence as compromised infrastructure - attacker-controlled hosts, bullet-proof hosting, or compromised legitimate servers used to route attacks. Requires a threat intel feed connected to Sentinel."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Block the TI-matched IP in Conditional Access",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "If sign-in was successful: treat as GEN-IA-016 (credential c",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "If sign-in was successful: treat as GEN-IA-016 (credential compromise) — revoke and reset"
    },
    {
      "name": "Report TI matches to your threat intelligence team for attri",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Report TI matches to your threat intelligence team for attribution"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-RD-002 — Compromised Infrastructure Used Against Tenant",
        "description": "Flags sign-in attempts from IPs flagged in threat intelligence as compromised infrastructure - attacker-controlled hosts, bullet-proof hosting, or compromised legitimate servers used to route attacks. Requires a threat intel feed connected to Sentinel. (Source: Bell Integration baseline detection library.)",
        "query": "let TIIndicators = (\n    ThreatIntelligenceIndicator\n    | where Active == true and ExpirationDateTime > now()\n    | where IndicatorType in (\"ipv4-addr\", \"ipv6-addr\")\n    | where ConfidenceScore >= 70\n    | project TI_IP = NetworkIP, ThreatType, Description, ConfidenceScore\n);\nSigninLogs\n| where TimeGenerated >= ago(1h)\n| join kind=inner TIIndicators on $left.IPAddress == $right.TI_IP\n| project\n    TimeGenerated, UserPrincipalName, IPAddress, ResultType, AppDisplayName,\n    ThreatType, Description, ConfidenceScore\n| extend timestamp = TimeGenerated, AccountCustomEntity = UserPrincipalName, IPCustomEntity = IPAddress\n| order by ConfidenceScore desc"
      },
      {
        "name": "9129a43e-e204-4a9a-969e-d8861ce3437c — GCP Audit Logs - DNSSEC Disabled on Managed DNS Zone",
        "description": "Detects when DNSSEC (DNS Security Extensions) is disabled on a Google Cloud DNS managed zone. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks. Adversaries may disable DNSSEC to enable DNS-based command and control, phishing campaigns, or to redirect traffic to malicious infrastructure without cryptographic validation. This rule monitors DNS zone patch operations where DNSSEC state changes from ON to OFF.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed), mapped via sub-technique T1584.002.)",
        "query": "GCPAuditLogs\n| where ServiceName == \"dns.googleapis.com\"\n| where MethodName in (\"dns.managedZones.update\", \"dns.managedZones.patch\")\n| where GCPResourceType == \"dns_managed_zone\" and Severity == \"NOTICE\"\n| extend \n    ResponseJson = parse_json(Response),\n    RequestMetadataJson = parse_json(RequestMetadata),\n    AuthInfoJson = parse_json(AuthenticationInfo)\n| extend ZoneContext = ResponseJson.operation.zoneContext\n| where isnotempty(ZoneContext)\n| extend \n    OldDnsSecState = tostring(ZoneContext.oldValue.dnssecConfig.state),\n    NewDnsSecState = tostring(ZoneContext.newValue.dnssecConfig.state)\n| where OldDnsSecState == \"ON\" and NewDnsSecState == \"OFF\"\n| extend \n    ManagedZoneName = extract(@\"managedZones/([^/]+)\", 1, GCPResourceName),\n    DnsName = tostring(ResponseJson.managedZone.dnsName),\n    ZoneId = tostring(ResponseJson.managedZone.id),\n    ZoneDescription = tostring(ResponseJson.managedZone.description),\n    Visibility = tostring(ResponseJson.managedZone.visibility),\n    OperationId = tostring(ResponseJson.operation.id),\n    CallerIpAddress = tostring(RequestMetadataJson.callerIp),\n    AuthEmail = tostring(AuthInfoJson.principalEmail)\n| extend \n    AccountName = tostring(split(PrincipalEmail, \"@\")[0]), \n    AccountUPNSuffix = tostring(split(PrincipalEmail, \"@\")[1])\n| project TimeGenerated,\n          PrincipalEmail,\n          AuthEmail,\n          ProjectId,\n          ManagedZoneName,\n          DnsName,\n          ResourceName = GCPResourceName,\n          Visibility,\n          ZoneId,\n          ZoneDescription,\n          OperationId,\n          CallerIpAddress,\n          MethodName,\n          ServiceName,\n          Severity,\n          LogName,\n          InsertId,\n          AccountName,\n          AccountUPNSuffix"
      },
      {
        "name": "374a77f4-23ed-55dc-8441-8e47a1e079e9 — Whisper Security - Co-Hosted Malware Cluster Detection",
        "description": "Identifies IP addresses that host multiple domains associated with malware. When an IP has more than 3 co-hosted domains and at least 3 of those domains are flagged as malware by Whisper threat intelligence, it strongly indicates compromised or adversary-controlled infrastructure. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "// MITRE ATT&CK: T1584.001 - Compromise Infrastructure: Domains\n// Tactic: Resource Development\n// Detects clusters of malware-hosting domains sharing the same IP infrastructure\nlet minCohostedCount = 3;\nlet minMalwareCoHosts = 3;\nlet cohostedInfra = WhisperInfraContext_CL\n    | where TimeGenerated > ago(1d)\n    | where cohostedCount > minCohostedCount\n    | extend parsedIp = tostring(split(ipAddresses, \",\")[0])\n    | project indicator, parsedIp, cohostedCount, countries, registrar;\nlet malwareIndicators = WhisperThreatIntel_CL\n    | where TimeGenerated > ago(1d)\n    | where isMalware == true\n    | project indicator, threatScore, threatLevel, feedNames;\ncohostedInfra\n    | join kind=inner (malwareIndicators) on indicator\n    | summarize malwareCoHostCount = dcount(indicator), DnsDomains = make_set(indicator, 10), avgThreatScore = avg(threatScore), maxThreatScore = max(threatScore) by parsedIp, cohostedCount, countries, registrar\n    | where malwareCoHostCount >= minMalwareCoHosts\n    | extend DnsDomain = tostring(DnsDomains[0]), IPAddress = parsedIp\n    | project TimeGenerated = now(), DnsDomain, IPAddress, malwareCoHostCount, cohostedCount, avgThreatScore, maxThreatScore, countries, registrar, DnsDomains"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "12051077-0124-4394-9522-8f4f4db1d674 — AWS Route 53 Domain Transfer Lock Disabled",
        "description": "(KUERY) Identifies when the transfer lock on an AWS Route 53 domain is disabled. The transfer lock protects domains from being moved to another registrar or AWS account without authorization. Disabling this lock removes an important safeguard against domain hijacking... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "data_stream.dataset: aws.cloudtrail \n    and event.provider: route53domains.amazonaws.com \n    and event.action: DisableDomainTransferLock \n    and event.outcome: success"
      },
      {
        "name": "2045567e-b0af-444a-8c0b-0b6e2dae9e13 — AWS Route 53 Domain Transferred to Another Account",
        "description": "(KUERY) Identifies when an AWS Route 53 domain is transferred to another AWS account. Transferring a domain changes administrative control of the DNS namespace, enabling the receiving account to modify DNS records, route traffic, request certificates, and potentially hijack operational workloads... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "data_stream.dataset: aws.cloudtrail \n    and event.provider: route53domains.amazonaws.com \n    and event.action: TransferDomainToAnotherAwsAccount \n    and event.outcome: success"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Compromise Infrastructure activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1584 - Compromise Infrastructure Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}