Acquire and/or use 3rd party software services

A wide variety of 3rd party software services are available (e.g., Twitter, Dropbox, GoogleDocs). Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. [1] [2]

ID: T1308
Sub-techniques:  No sub-techniques
Tactic: Adversary Opsec
Version: 1.0
Created: 14 December 2017
Last Modified: 17 October 2018

Similar Techniques by Tactic

Tactic Technique
Establish & Maintain Infrastructure Acquire and/or use 3rd party software services


Detectable by Common Defenses (Yes/No/Partial): No

Explanation: Defender will not have visibility over account creation for 3rd party software services.

Difficulty for the Adversary

Easy for the Adversary (Yes/No): Yes

Explanation: 3rd party services like these listed are freely available.


  1. Forward-Looking Threat Research Team. (2012). LUCKYCAT REDUX: Inside an APT Campaign with Multiple Targets in India and Japan. Retrieved March 1, 2017.
  1. Bart Blaze. (2016, November 20). Nemucod downloader spreading via Facebook. Retrieved March 28, 2017.