T1588

Obtain Capabilities

Resource Development Last updated:

This detection identifies adversary capability acquisition activity manifesting within the victim environment — specifically, the arrival, staging, and first execution of known offensive tools, exploit frameworks, and dual-use security utilities. While T1588 is a PRE-ATT&CK technique occurring outside the victim network, its downstream effects are observable: offensive tools landing in atypical directories (Temp, Downloads, user profile paths), processes executing with names or command-line arguments matching known offensive frameworks (Cobalt Strike, Mimikatz, Rubeus, Sliver, Havoc, Impacket), downloads via living-off-the-land binaries (certutil, bitsadmin, curl), and network connections to known exploit distribution infrastructure. The detection correlates process creation events, file download artifacts, and network telemetry to surface high-risk capability introductions across Windows and Linux endpoints.

What is T1588 Obtain Capabilities?

Obtain Capabilities (T1588) maps to the Resource Development tactic — the adversary is trying to establish resources they can use to support operations in MITRE ATT&CK.

This page provides production-ready detection logic for Obtain Capabilities, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Resource Development
Technique
T1588 Obtain Capabilities
Canonical reference
https://attack.mitre.org/techniques/T1588/
Microsoft Sentinel / Defender
kusto 
let LookbackDays = 7d;
let OffensiveToolKeywords = dynamic([
    "mimikatz", "cobalt", "cobaltstrike", "cs_beacon", "beacon",
    "meterpreter", "metasploit", "empire", "covenant", "sliver",
    "havoc", "brute_ratel", "nighthawk", "noctiluca", "mythic",
    "lazagne", "dumpert", "nanodump", "procdump64",
    "rubeus", "kerberoast", "asreproast", "certify", "certipy",
    "sharphound", "bloodhound", "adrecon", "adexplorer",
    "responder", "inveigh", "powerupsql", "mssqlpwner",
    "chisel", "ligolo", "frp", "plink", "ngrok"
]);
let SuspiciousStagingPaths = dynamic([
    "\\Temp\\", "\\tmp\\", "\\Downloads\\",
    "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\",
    "\\ProgramData\\", "\\Users\\Public\\"
]);
let LOLBinDownloaders = dynamic([
    "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe",
    "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe",
    "cscript.exe", "regsvr32.exe", "rundll32.exe"
]);
// Branch 1: Known offensive tool name match in process name or command line
let ToolNameHits = DeviceProcessEvents
| where Timestamp > ago(LookbackDays)
| where FileName has_any (OffensiveToolKeywords)
    or ProcessCommandLine has_any (OffensiveToolKeywords)
| extend DetectionBranch = "OffensiveToolNameMatch"
| extend RiskScore = case(
    FileName has_any ("mimikatz", "meterpreter", "cobalt", "beacon"), 100,
    FileName has_any ("rubeus", "certify", "certipy", "bloodhound", "sharphound"), 90,
    FileName has_any ("responder", "inveigh", "lazagne", "dumpert"), 85,
    FileName has_any ("chisel", "ligolo", "havoc", "sliver", "empire"), 80,
    ProcessCommandLine has_any ("mimikatz", "sekurlsa", "kerberos::ptt", "lsadump"), 100,
    ProcessCommandLine has_any ("rubeus", "kerberoast", "/nowrap", "asreproast"), 90,
    70
);
// Branch 2: LOLBin downloaders staging to suspicious paths
let LOLBinDownloads = DeviceProcessEvents
| where Timestamp > ago(LookbackDays)
| where FileName in~ (LOLBinDownloaders)
| where ProcessCommandLine has_any (SuspiciousStagingPaths)
    and (ProcessCommandLine has "http" or ProcessCommandLine has "ftp" or ProcessCommandLine has "urlcache" or ProcessCommandLine has "-split" or ProcessCommandLine has "DownloadFile" or ProcessCommandLine has "DownloadString" or ProcessCommandLine has "WebClient")
| extend DetectionBranch = "LOLBinCapabilityDownload"
| extend RiskScore = case(
    ProcessCommandLine has "certutil" and ProcessCommandLine has "urlcache", 85,
    ProcessCommandLine has "bitsadmin" and ProcessCommandLine has "/transfer", 85,
    ProcessCommandLine has_any ("DownloadFile", "DownloadString", "IEX", "Invoke-Expression"), 90,
    75
);
// Branch 3: Execution from staging paths by non-standard parent
let StagingPathExecution = DeviceProcessEvents
| where Timestamp > ago(LookbackDays)
| where FolderPath has_any (SuspiciousStagingPaths)
| where InitiatingProcessFileName !in~ ("explorer.exe", "msiexec.exe", "setup.exe", "install.exe", "update.exe", "teams.exe", "chrome.exe", "msedge.exe", "firefox.exe")
| where FileName !endswith ".tmp"
| extend DetectionBranch = "StagingPathExecution"
| extend RiskScore = 65;
union ToolNameHits, LOLBinDownloads, StagingPathExecution
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, RiskScore
| sort by RiskScore desc, Timestamp desc

Detects potential capability acquisition activity across three branches: (1) execution of processes matching known offensive tool names or command-line patterns, (2) living-off-the-land binaries (certutil, bitsadmin, PowerShell) performing downloads to suspicious staging directories, and (3) binary execution from non-standard paths like Temp and Downloads when launched by non-browser parent processes. Each branch is scored by risk level to prioritize analyst review.

high severity medium confidence

Data Sources

Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Security researchers and red team operators running authorized assessments — certutil and PowerShell downloads are common in legitimate engagements
  • IT administrators staging software packages in Temp directories during patch cycles or manual deployments
  • Dual-use tools like ADExplorer, ProcDump, or BloodHound used by authorized IT/security teams for inventory and health assessments
  • Developer workstations cloning security tool repositories from GitHub for research or tooling review
  • Penetration testing firms with approved assessments whose infrastructure overlaps with known offensive tool signatures

Sigma rule & cross-platform mapping

The detection logic for Obtain Capabilities (T1588) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1588 Sigma rules on detection.fyi

Platform-specific guides for T1588

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-03-19 Research depth: deep
References (2)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1LOLBin Capability Download via CertUtil

    Expected signal: Sysmon EventCode=1 with Image=certutil.exe, CommandLine containing '-urlcache' and '-split'; Sysmon EventCode=11 (FileCreate) for the downloaded file in %TEMP%; possible DNS query in EventCode=22 for the target hostname

  2. Test 2PowerShell Download Cradle to Staging Path

    Expected signal: Sysmon EventCode=1 with Image=powershell.exe and CommandLine containing 'DownloadFile' and 'WebClient'; Sysmon EventCode=3 (NetworkConnect) to target IP; Sysmon EventCode=11 (FileCreate) in %TEMP%

  3. Test 3Offensive Tool Naming Pattern Execution from Temp

    Expected signal: Sysmon EventCode=1 with Image path containing %TEMP%\mimikatz_test.exe; parent process is cmd.exe; CommandLine includes /all argument; Sysmon EventCode=11 for file copy to staging path

  4. Test 4BITS Transfer Capability Staging

    Expected signal: Sysmon EventCode=1 with Image=bitsadmin.exe and CommandLine containing '/transfer' and target URL; Sysmon EventCode=11 for file creation in %TEMP%; Windows Event 16403 in Microsoft-Windows-Bits-Client/Operational log recording the completed transfer job

Response Playbook

Triage

  1. Step 1: Identify the detection branch that fired (OffensiveToolNameMatch, LOLBinCapabilityDownload, PowerShellDownload, or StagingPathExecution) and pull the full process tree using DeviceProcessEvents filtered on DeviceId and AccountSid within ±30 minutes of the alert timestamp.
  2. Step 2: Examine the initiating process chain — trace from grandparent to child. A browser spawning PowerShell which spawns a tool in Temp is a high-confidence indicator; msiexec or a known software installer spawning into Temp is likely a false positive.
  3. Step 3: Hash the suspicious binary using DeviceFileEvents or manually via endpoint EDR. Submit the hash to VirusTotal, MalwareBazaar, or your internal threat intel feed to determine if it is a known malware/tool variant.
  4. Step 4: Check DeviceNetworkEvents for outbound connections from the suspicious process. Correlate RemoteIP against threat intel (AbuseIPDB, Shodan, internal block lists) to identify C2 infrastructure, exploit kit hosting, or dark web marketplace domains.
  5. Step 5: Review DeviceLogonEvents for the same AccountName in the 24 hours prior to the alert. Look for unusual authentication patterns — logins from new source IPs, off-hours access, or privileged account usage — that may indicate the account was used to acquire capabilities.
  6. Step 6: Query DeviceFileEvents for new PE files (.exe, .dll) or script files (.ps1, .py, .vbs) dropped in staging paths (Temp, Downloads, AppData) within the same session window to identify what was staged.
  7. Step 7: Determine whether the activity was authorized. Check the change management system or contact the endpoint owner to confirm if a pentest or security assessment is in progress.

Containment

  1. If the binary is confirmed malicious: isolate the endpoint using EDR response actions (Microsoft Defender for Endpoint: Isolate Device action) to prevent lateral movement while preserving forensic state.
  2. Suspend the associated user account in Azure AD / Active Directory to prevent the threat actor from using the same identity to re-acquire capabilities or deploy tools elsewhere.
  3. Block the RemoteIP/domain observed in DeviceNetworkEvents at the firewall and web proxy layer. Apply a network IOC to your SIEM for retrospective hunting across the fleet.
  4. If certutil or bitsadmin was used to download the capability, check BITS queue persistence (bitsadmin /list /allusers) and clear any queued transfer jobs that reference malicious URLs.
  5. Quarantine the dropped file through EDR quarantine actions to preserve evidence while preventing re-execution. Do not delete — maintain for forensic analysis.

Evidence Collection

  1. Export the full Sysmon ProcessCreate (Event 1) chain for the suspicious process and all child processes to a timestamped log bundle.
  2. Collect the suspicious binary and all files created in the staging directory using EDR live response or forensic acquisition. Compute SHA-256 hashes for each file.
  3. Pull Windows Prefetch files (C:\Windows\Prefetch\) for the suspicious executable — Prefetch timestamps reveal first and last execution times, confirming when the capability was first run.
  4. Export PowerShell ScriptBlock logs (Event 4104) and Module logs (Event 4103) from the affected host for the session window. These capture decoded download cradle content even if obfuscated.
  5. Collect browser history and download history (Chrome: History SQLite DB at %LOCALAPPDATA%\Google\Chrome\User Data\Default\History; Edge: %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History) to trace how the capability was initially obtained.
  6. Capture network packet data (PCAP) from the relevant time window via sensor/TAP if available to reconstruct the download session and identify TLS certificate details of the delivery server.

Escalation Criteria

  • ! Escalate immediately if the suspicious tool is confirmed to be an active C2 implant (Cobalt Strike beacon, Sliver, Havoc, Brute Ratel) — this indicates the adversary has already moved from capability acquisition to active intrusion.
  • ! Escalate if the same tool or download pattern is detected on more than one host within a 24-hour window — this suggests coordinated deployment, not isolated staging.
  • ! Escalate if lateral movement indicators (SMB authentication from the affected host to other systems via Event 4624/4648, new service creation via Event 7045, scheduled tasks via Event 4698) appear within 2 hours of capability acquisition.
  • ! Escalate if credential access indicators (LSASS access via Sysmon Event 10, SAM registry access, DCSync patterns) follow within the same session — the threat actor is immediately operationalizing the acquired capability.
  • ! Escalate if the affected account holds privileged roles (Domain Admin, Global Admin, Security Admin) — a privileged identity acquiring offensive tools represents critical severity regardless of other indicators.

Investigation Guide

Forensic Artifacts

  • > Windows Prefetch files: %SystemRoot%\Windows\Prefetch\<TOOLNAME>-*.pf — confirm first and last execution time of acquired tools
  • > NTFS $MFT and $LogFile: timestomping and file creation metadata for newly staged binaries in Temp/Downloads/AppData paths
  • > PowerShell ScriptBlock logs: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging (Event 4104) — capture download cradle commands
  • > BITS persistent jobs: check BITS queue at %ALLUSERSPROFILE%\Microsoft\Network\Downloader\ for queued or completed transfer records referencing malicious URLs
  • > Browser download history: Chrome/Edge/Firefox SQLite databases record URL, filename, and timestamp of web downloads
  • > Windows Event Log 4688 (Security) or Sysmon Event 1: process creation records capturing command-line arguments of tool execution
  • > AmCache.hve and ShimCache: record first-time execution evidence for binaries even after deletion
  • > Zone.Identifier ADS (Alternate Data Stream): files downloaded from the internet retain ZoneId=3 in their ADS, confirming web-sourced origin
  • > Certutil log: certutil download operations leave URL cache artifacts at %USERPROFILE%\AppData\LocalLow\Microsoft\CryptnetUrlCache\

Tuning Guidance

Start by allowlisting known security tool paths authorized by your red team or IT security team — maintain a shared list with hashes to exclude from OffensiveToolNameMatch alerts. For LOLBinCapabilityDownload, add known software update servers and internal package repositories (Chocolatey internal mirror, WSUS, SCCM distribution points) to an exclusion list. Tune the StagingPathExecution branch by adding additional trusted parent process names specific to your environment (e.g., your MDM agent, patch management binary, or custom software deployer). If you use endpoint DLP, consider correlating alerts with DLP events to distinguish authorized tool usage from unauthorized acquisition. For the Zone.Identifier hunt, exclude your corporate software deployment tool's download directories. Set a higher risk score threshold (>=75) in environments with active red team programs to reduce noise while maintaining detection of unplanned tool introduction.

Hunting Queries

Hunt for new executable and script files dropped in staging directories by non-installer processes — surfaces capability delivery activity missed by process-name-based detections

Hunting — KQL
kql 
// Hunt: New PE/script files appearing in staging paths without matching installer parent
let StagingPaths = dynamic(["\\Temp\\", "\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\"]);
let TrustedInstallerParents = dynamic(["msiexec.exe", "setup.exe", "install.exe", "update.exe", "winget.exe", "chocolatey.exe"]);
DeviceFileEvents
| where Timestamp > ago(14d)
| where FolderPath has_any (StagingPaths)
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".py" or FileName endswith ".jar"
| where InitiatingProcessFileName !in~ (TrustedInstallerParents)
| join kind=leftouter (
    DeviceProcessEvents
    | where Timestamp > ago(14d)
    | project DeviceId, SHA256, ExecutionTime = Timestamp, ExecutionCommandLine = ProcessCommandLine
    | summarize FirstExecution = min(ExecutionTime), ExecCommands = make_set(ExecutionCommandLine, 5) by DeviceId, SHA256
) on DeviceId, $left.SHA256 == $right.SHA256
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, FirstExecution, ExecCommands
| where isnotempty(FirstExecution)
| sort by Timestamp desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*\\Temp\\*" OR TargetFilename="*\\Downloads\\*" OR TargetFilename="*\\AppData\\Local\\Temp\\*" OR TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\ProgramData\\*")
(TargetFilename="*.exe" OR TargetFilename="*.dll" OR TargetFilename="*.ps1" OR TargetFilename="*.py" OR TargetFilename="*.jar")
NOT (Image="*\\msiexec.exe" OR Image="*\\setup.exe" OR Image="*\\winget.exe" OR Image="*\\chocolatey.exe")
| stats count, values(TargetFilename) as files_dropped, values(Image) as creating_process, dc(TargetFilename) as unique_files by Computer, User
| where unique_files >= 1
| sort -unique_files

Hunt for files with Zone.Identifier ADS (indicating web download origin) that are executed within 5 minutes of being written — identifies rapid weaponization of downloaded capabilities

Hunting — KQL
kql 
// Hunt: Zone.Identifier ADS creation followed by immediate execution (web-downloaded binary)
DeviceFileEvents
| where Timestamp > ago(14d)
| where FileName endswith ":Zone.Identifier" and ActionType == "FileCreated"
| extend BaseFileName = replace_string(FileName, ":Zone.Identifier", "")
| extend BaseFolderPath = FolderPath
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(14d)
    | project DeviceId, ExecTime = Timestamp, ExecFile = FileName, ExecPath = FolderPath, ExecCommandLine = ProcessCommandLine, SHA256
) on DeviceId
| where ExecPath == BaseFolderPath and ExecFile == BaseFileName
| where ExecTime between (Timestamp .. (Timestamp + 5m))
| project ZoneMarkTime = Timestamp, ExecTime, DeviceName, AccountName, BaseFileName, BaseFolderPath, ExecCommandLine, SHA256
| sort by ZoneMarkTime desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=15
| rename TargetFilename as zone_file
| eval base_file=replace(zone_file, ":Zone.Identifier", "")
| eval base_dir=replace(base_file, "\\[^\\]+$", "")
| join type=inner Computer [
    search index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    | rename Image as executed_image
    | table Computer, executed_image, CommandLine, _time
]
| eval time_delta = abs(_time - time)
| where time_delta <= 300 AND like(executed_image, "%" + replace(base_file, ".*\\\\", "") + "%")
| table _time, Computer, User, zone_file, executed_image, CommandLine
| sort -_time

Hunt for non-browser processes making outbound connections to file-sharing and code-hosting platforms commonly used to distribute offensive tools — bypasses tool name matching by focusing on delivery infrastructure

Hunting — KQL
kql 
// Hunt: Outbound connections to exploit/tool hosting patterns from non-browser processes
let BrowserProcesses = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "opera.exe", "brave.exe", "safari.exe"]);
DeviceNetworkEvents
| where Timestamp > ago(14d)
| where ActionType in ("ConnectionSuccess", "HttpConnectionInspected")
| where InitiatingProcessFileName !in~ (BrowserProcesses)
| where InitiatingProcessFileName !in~ ("svchost.exe", "MsMpEng.exe", "SenseIR.exe", "MonitoringHost.exe", "WaAppAgent.exe")
| where RemoteUrl has_any ("github.com", "gitlab.com", "raw.githubusercontent.com", "pastebin.com", "paste.ee", "hastebin.com", "anonfiles.com", "gofile.io", "mega.nz", "mediafire.com")
    and (RemoteUrl has_any (".exe", ".dll", ".ps1", ".zip", ".7z", "release", "download", "payload", "beacon", "agent"))
| summarize ConnectionCount = count(), UniqueURLs = dcount(RemoteUrl), SampleURLs = make_set(RemoteUrl, 5) by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by ConnectionCount desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
NOT (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe" OR Image="*\\svchost.exe" OR Image="*\\MsMpEng.exe")
(DestinationHostname="*github.com" OR DestinationHostname="*gitlab.com" OR DestinationHostname="*pastebin.com" OR DestinationHostname="*paste.ee" OR DestinationHostname="*anonfiles.com" OR DestinationHostname="*gofile.io" OR DestinationHostname="*mega.nz")
(DestinationPort=80 OR DestinationPort=443 OR DestinationPort=8080)
| stats count as connection_count, dc(DestinationHostname) as unique_hosts, values(DestinationHostname) as contacted_hosts, values(Image) as initiating_processes by Computer, User
| sort -connection_count

Atomic Red Team Tests

Test 1 LOLBin Capability Download via CertUtil
windows

Simulates an adversary using certutil.exe to download a tool binary to a staging directory — a common technique for transferring capabilities to compromised hosts while bypassing application controls.

Command

powershell 
certutil.exe -urlcache -split -f "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1588/bin/T1588_test_payload.txt" "%TEMP%\capability_test.txt" & echo Downloaded successfully

Cleanup

powershell 
del /f /q "%TEMP%\capability_test.txt" & certutil.exe -urlcache -split -f "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1588/bin/T1588_test_payload.txt" delete

Expected Telemetry

Sysmon EventCode=1 with Image=certutil.exe, CommandLine containing '-urlcache' and '-split'; Sysmon EventCode=11 (FileCreate) for the downloaded file in %TEMP%; possible DNS query in EventCode=22 for the target hostname

Expected Detection

LOLBinCapabilityDownload branch alert — certutil.exe with urlcache/split arguments downloading to %TEMP% path

Test 2 PowerShell Download Cradle to Staging Path
windows

Simulates an adversary using PowerShell WebClient to download a capability from a remote server to a staging directory, mimicking common capability acquisition and staging tradecraft.

Command

powershell 
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt', "$env:TEMP\capability_download_test.txt"); Write-Host 'Download complete'"

Cleanup

powershell 
powershell.exe -Command "Remove-Item -Force '$env:TEMP\capability_download_test.txt' -ErrorAction SilentlyContinue"

Expected Telemetry

Sysmon EventCode=1 with Image=powershell.exe and CommandLine containing 'DownloadFile' and 'WebClient'; Sysmon EventCode=3 (NetworkConnect) to target IP; Sysmon EventCode=11 (FileCreate) in %TEMP%

Expected Detection

PowerShellDownload branch alert — PowerShell using WebClient.DownloadFile with output to staging path

Test 3 Offensive Tool Naming Pattern Execution from Temp
windows

Simulates the execution of a binary with a name matching known offensive tool patterns from a staging directory — validates that the OffensiveToolNameMatch detection branch triggers on tool name indicators rather than requiring known malware hashes.

Command

powershell 
copy "%WINDIR%\System32\whoami.exe" "%TEMP%\mimikatz_test.exe" && "%TEMP%\mimikatz_test.exe" /all

Cleanup

powershell 
del /f /q "%TEMP%\mimikatz_test.exe"

Expected Telemetry

Sysmon EventCode=1 with Image path containing %TEMP%\mimikatz_test.exe; parent process is cmd.exe; CommandLine includes /all argument; Sysmon EventCode=11 for file copy to staging path

Expected Detection

OffensiveToolNameMatch branch alert — process name 'mimikatz_test.exe' matches offensive tool keyword 'mimikatz' in staging directory path

Test 4 BITS Transfer Capability Staging
windows

Simulates an adversary leveraging Background Intelligent Transfer Service (bitsadmin) to download a capability in the background — commonly used to blend with legitimate Windows update traffic.

Command

powershell 
bitsadmin.exe /transfer CapabilityTest /download /priority normal "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/LICENSE.txt" "%TEMP%\bits_capability_test.txt" && bitsadmin.exe /complete CapabilityTest

Cleanup

powershell 
del /f /q "%TEMP%\bits_capability_test.txt" & bitsadmin.exe /cancel CapabilityTest 2>nul & bitsadmin.exe /reset

Expected Telemetry

Sysmon EventCode=1 with Image=bitsadmin.exe and CommandLine containing '/transfer' and target URL; Sysmon EventCode=11 for file creation in %TEMP%; Windows Event 16403 in Microsoft-Windows-Bits-Client/Operational log recording the completed transfer job

Expected Detection

LOLBinCapabilityDownload branch alert — bitsadmin.exe /transfer downloading to %TEMP% staging path

Related Detections

Tactic Hub

TA0042Resource Development

Sub-techniques (7)

Related Techniques

T1587Develop CapabilitiesT1583Acquire InfrastructureT1588.001MalwareT1588.002ToolT1588.003Code Signing CertificatesT1588.004Digital CertificatesT1588.005ExploitsT1588.006VulnerabilitiesT1588.007Artificial IntelligenceT1105Ingress Tool TransferT1059Command and Scripting InterpreterT1140Deobfuscate/Decode Files or Information

Same Tactic: Resource Development

Popular Detections