Domains
Sub-technique of AML.T0008 Acquire Infrastructure
Description
Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
Adversaries may use acquired domains for a variety of purposes (see ATT&CK). Large AI datasets are often distributed as a list of URLs to individual datapoints. Adversaries may acquire expired domains that are included in these datasets and replace individual datapoints with poisoned examples (Publish Poisoned AI Artifacts: Datasets).
- ATLAS ID
- AML.T0008.002
- Maturity
- DemonstratedShown to work in research or red-team exercises.
- Platforms
- Enterprise
Mitigations
ATLAS 2026.09 lists no mitigation for this technique; see the parent technique.
Case studies that use it
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.