MITRE ATT&CK Resource Development

How Resource Development Fits into the ATT&CK Lifecycle

Resource Development describes the preparatory phase of an intrusion campaign, when an adversary builds the assets needed to operate later. In ATT&CK terms, that preparation can include domains, hosting, accounts, malware, and other infrastructure that supports delivery, command infrastructure, persistence, or follow-on operations.

This phase matters because it often happens before defenders see any direct intrusion against the target. The activity can look ordinary in isolation, such as registering a domain or provisioning cloud resources, but the attacker’s intent is to create the conditions for later abuse.

Resource Development is therefore less about the final compromise action and more about the operational supply chain behind it. It helps explain why defenders should care about precursor activity, not just malware execution or post-compromise behavior.

What Adversaries Use Resource Development For

Attackers use resource development to increase reliability, scale, and resilience. Pre-positioned infrastructure can support phishing, malware staging, redirection, proxying, credential collection, or fallback communications after a foothold is established.

It also helps attackers separate their preparation from their operations. A campaign may use one set of assets to register domains, another to host payloads, and a third to manage control infrastructure, which makes attribution and takedown more difficult.

Because the assets are often disposable, the danger is not only individual compromise but the speed with which new infrastructure can be created, rotated, or replaced. That makes resource development a force multiplier for persistent threat activity.

Why Resource Development Is a Defensive Signal

For defenders, the value of this ATT&CK stage is that it creates earlier warning opportunities. Domain registration patterns, suspicious hosting, lookalike identities, public-repository leakage, and pre-attack infrastructure can all indicate preparation long before an endpoint alert fires. The OSINT and Reconnaissance Guide is useful here because exposed footprint and public artefacts often overlap with the preparation phase.

Resource Development is also a useful lens for measuring adversary maturity. Well-resourced actors tend to reuse infrastructure tradecraft, maintain staging environments, and distribute dependencies across multiple assets. That pattern can inform threat-informed prioritisation rather than treating every malicious indicator as isolated noise.

Defenders should think in terms of campaign enablement. If the organisation only watches for payload delivery, it may miss the upstream infrastructure that made the campaign viable in the first place.

How Teams Map and Operationalise ATT&CK Resource Development

Teams usually operationalise this concept by connecting it to threat intelligence, external attack surface monitoring, and detection engineering. ATT&CK-based analysis helps analysts map observed domains, hosting, certificates, accounts, or staging assets to broader adversary behaviour rather than treating them as standalone events.

The most practical workflow is to pair campaign analysis with control coverage and response playbooks. The MITRE ATT&CK Guide for Defenders supports that mapping, while the Threat-Informed Defence Guide helps translate observed tactics into prioritised detection and testing. For response workflow structure, the SOC Runbook Template is a practical companion when teams need to turn ATT&CK observations into investigation steps and closure criteria.

MITRE’s own ATT&CK knowledge base is the authoritative reference for the technique family and its relationship to other stages of intrusion, so it should remain the primary external source for technique semantics and mappings. In practice, that means using ATT&CK to classify what you see, then using your detection and response programme to decide what to do next.

Risk and Threat Considerations

Resource Development creates risk because it lets adversaries build reusable infrastructure before a target ever sees the intrusion. That preparation can support persistence, redundancy, and campaign continuity, which makes takedown harder and increases the likelihood of repeated abuse.

Failure mechanism: Defenders often focus on malicious payloads and miss the upstream domains, accounts, hosting, and staging assets that make the operation possible.

Impact: That gap delays detection, widens exposure windows, and gives attackers more time to pivot, rotate infrastructure, and launch follow-on activity.

Related resources from NHI Mgmt Group

• How should security teams use MITRE ATT&CK in identity programmes?
• Why does MITRE ATT&CK matter for NHI governance?
• How do security teams know if automated MITRE ATT&CK coverage reporting is trustworthy?
• How should security teams use LLMs to map Sigma rules to MITRE ATT&CK?