Cross-source coverage

T1608 / ATT&CK

Stage Capabilities

14 rules · 13 families across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.

Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

  • Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site.
  • Staging web resources for a link target to be used with spearphishing.
  • Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer.
  • Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).
Platforms
PRE
Telemetry
Internet Scan

How MITRE says to detect it DET0839

Detection of Stage Capabilities

PRE Analytic 1971

If infrastructure or patterns in malware, tooling, certificates, or malicious web content have been previously identified, internet scanning may uncover when an adversary has staged their capabilities. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as initial access and post-compromise behaviors.

  • Internet Scan None

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 14 above — a rule tagged a sub-technique covers this technique too.

splunk/security_content

5 rules
Detection Severity Format
Linux Suspicious GCC Invocation Building Init Shared Object Undefined SPL
Windows Cobalt Strike PowerShell Loader Undefined SPL
Windows Metasploit Confluence Plugin Execution Undefined SPL
Windows NorthStar C2 Agent Execution Undefined SPL
Windows Unusual File Creation in Confluence Directory Undefined SPL

elastic/detection-rules

4 rules
Detection Severity Format
M365 OneDrive Malware File Upload High Elastic TOML
M365 SharePoint Malware File Detected High Elastic TOML
AWS SNS Topic Created by Rare User Low Elastic TOML
Azure Automation Webhook Created Low Elastic TOML

SigmaHQ/sigma

3 rules
Detection Severity Format
AWS KMS Imported Key Material Usage High Sigma
HybridConnectionManager Service Installation - Registry High Sigma
Suspicious Download from Office Domain High Sigma

panther-labs/panther-analysis

2 rules
Detection Severity Format
AppOmni Alert Passthrough Medium Panther Python
Azure Automation Webhook Created Informational Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.