{"id":"T1683.001","name":"Written Content","url":"https://attack.mitre.org/techniques/T1683/001","tactics":["resource-development"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0917","stix_id":"x-mitre-detection-strategy--bbda89d6-a007-4ba9-bfd0-cb03344fc540","name":"Detection of Written Content","url":"https://attack.mitre.org/detectionstrategies/DET0917","analytics":[{"id":"AN2060","stix_id":"x-mitre-analytic--3c500af0-d284-48c3-b23b-a22f8b77649d","name":"Analytic 2060","description":"Much of this takes place outside the visibility of the target organization, making detection difficult for defenders.\n\nDetection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.","url":"https://attack.mitre.org/detectionstrategies/DET0917#AN2060","platforms":["PRE"],"log_source_references":[],"mutable_elements":[],"live":true,"detection_strategies":["DET0917"],"techniques":["T1683.001"]}],"live":true,"version":"1.0","techniques":["T1683.001"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}