T1587 Develop Capabilities

Adversaries may build capabilities that can be used during targeting. MITRE ATT&CK

Its sub-techniques

MITRE ATT&CK

T1587.001Develop Capabilities: Malware

process creation, the highest levels first

criticalHackTool - PurpleSharp ExecutionFlorian Roth (Nextron Systems) · Windows

highLinux HackTool ExecutionNasreddine Bencherchali (Nextron Systems), Georg Lauenstein (sure[secure]) · Linux

everyday examples from tldr-pages, CC BY 4.0

Perform a brute-force attack (mode 3) with the default hashcat mask on the page for hashcat

hashcat --hash-type hash_type_id --attack-mode 3 hash_valueIdentify

Perform a brute-force attack (mode 3) with a known pattern of 4 digits on the page for hashcat

hashcat --hash-type hash_type_id --attack-mode 3 hash_value "?d?d?d?d"Identify

Perform a brute-force attack (mode 3) using at most 8 of all printable ASCII characters on the page for hashcat

hashcat --hash-type hash_type_id --attack-mode 3 --increment hash_value "?a?a?a?a?a?a?a?a"Identify

Launch the interactive console (append --quiet to suppress the startup banner) on the page for msfconsole

sudo msfconsoleIdentify

Execute console commands (Note: Use ; for passing multiple commands) on the page for msfconsole

sudo msfconsole --execute-command "use auxiliary/scanner/portscan/tcp; set PORTS 80,443; set RHOSTS example.com; run; quit"

Run a specific resource file on the page for msfconsole

sudo msfconsole --resource path/to/file.rcIdentify

Crack key from capture file using wordlist on the page for aircrack-ng

aircrack-ng -w path/to/wordlist.txt path/to/capture.capIdentify

Crack key using multiple CPU threads from capture file using wordlist on the page for aircrack-ng

aircrack-ng -p number -w path/to/wordlist.txt path/to/capture.capIdentify

Crack key from capture file using wordlist and the access point's essid on the page for aircrack-ng

aircrack-ng -w path/to/wordlist.txt -e extended_ssid path/to/capture.capIdentify

Crack key from capture file using wordlist and the access point's MAC address on the page for aircrack-ng

aircrack-ng -w path/to/wordlist.txt --bssid mac path/to/capture.capIdentify

Perform reconnaissance on target host(s) (detailed scan results will be dumped in results) on the page for autorecon

sudo autorecon host_or_ip1,host_or_ip2,...Identify

Perform reconnaissance on target(s) from a file on the page for autorecon

sudo autorecon --target-file path/to/fileIdentify

And 106 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1587: a Sigma rule it trips is tagged with it, or its abuse is documented as it.