ATT&CK technique · T1588.001

Obtain Capabilities: Malware

Resource Development· seen in 2 CISA KEV exploits

Full description, procedures and detections on attack.mitre.org

Who uses it

ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.

Weaknesses that lead here

Classes of exploited vulnerability that CTID maps to this technique.

CWE-1251 KEV CVEOut-of-bounds ReadCode reads beyond a buffer, leaking secrets such as keys or memory addresses that defeat other defences.
CWE-6931 KEV CVEProtection Mechanism FailureA security feature exists but can be bypassed or doesn't engage when it should.
CWE-7871 KEV CVEOut-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.

Controls that mitigate it (0)

NIST SP 800-53 rev5, grouped by family (CTID mapping).

No NIST SP 800-53 mapping for this technique.

Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.