# What is resource development in MITRE ATT&CK?

Resource development is the attacker preparing tools and infrastructure for an attack: renting servers, registering look-alike domains, buying or stealing accounts, obtaining malware or code-signing certificates, or buying access to a victim from an initial access broker. It happens on the attacker's side before anything reaches you, so there is little to detect directly. Its traces appear later, which is useful: a domain registered last week that resembles your supplier's, a destination on freshly rented cloud servers, a certificate issued days before the connection. Threat intelligence feeds and advisories publish such infrastructure. Register common misspellings of your own domain and set up DMARC, so that your name is harder to abuse. NetSenX does not watch attackers build their infrastructure; it sees your hosts connecting to it, such as beaconing to a new outside server.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-resource-development-in-mitre-attack

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is initial access in a cyberattack?](https://netsenx.com/en/faq/what-is-initial-access)
- [What does execution mean in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-execution-in-mitre-attack)
- [What is persistence in a cyberattack?](https://netsenx.com/en/faq/what-is-persistence-in-a-cyberattack)
- [What is privilege escalation?](https://netsenx.com/en/faq/what-is-privilege-escalation)
- [What is the Stealth tactic in MITRE ATT&CK?](https://netsenx.com/en/faq/what-is-the-stealth-tactic-in-mitre-attack)