Applied Cybernetics Group
T1584.005 — Botnet
- Technique
T1584.005- Tactics
- Resource Development
- MISP citations
- 0
- KEV CVEs mapped
- 2
- Community rules
- 0
- thrunt rules
- 0
- Active families
- Mirai
- Upstream
- https://attack.mitre.org/techniques/T1584/005
MITRE description
Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).
KEV CVEs mapped to this technique
Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.
Detection coverage
Coverage data unavailable in this snapshot (community inventory not yet ingested).