{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1608","id":"T1608","name":"Stage Capabilities","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1608","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"59be2ba40ced12efd4e38e7c90726809635a7b84611c522e21f2cd8a57a4b8e9","description":"Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or was otherwise compromised by them ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.(Citation: Volexity Ocean Lotus November 2020)(Citation: Dragos Heroku Watering Hole)(Citation: Malwarebytes Heroku Skimmers)(Citation: Netskope GCP Redirection)(Citation: Netskope Cloud Phishing)\n\nStaging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):\n\n* Staging web resources necessary to conduct [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)\n* Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)\n* Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105).(Citation: Volexity Ocean Lotus November 2020)\n* Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) with [Web Protocols](https://attack.mitre.org/techniques/T1071/001)).(Citation: DigiCert Install SSL Cert)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1608","external_id":"T1608"},{"source_name":"Volexity Ocean Lotus November 2020","description":"Adair, S. and Lancaster, T. (2020, November 6). OceanLotus: Extending Cyber Espionage Operations Through Fake Websites. Retrieved November 20, 2020.","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"},{"source_name":"Netskope GCP Redirection","description":"Ashwin Vamshi. (2019, January 24). Targeted Attacks Abusing Google Cloud Platform Open Redirection. Retrieved August 18, 2022.","url":"https://www.netskope.com/blog/targeted-attacks-abusing-google-cloud-platform-open-redirection"},{"source_name":"Netskope Cloud Phishing","description":"Ashwin Vamshi. (2020, August 12). A Big Catch: Cloud Phishing from Google App Engine and Azure App Service. Retrieved August 18, 2022.","url":"https://www.netskope.com/blog/a-big-catch-cloud-phishing-from-google-app-engine-and-azure-app-service"},{"source_name":"ATT ScanBox","description":"Blasco, J. (2014, August 28). Scanbox: A Reconnaissance Framework Used with Watering Hole Attacks. Retrieved October 19, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"},{"source_name":"DigiCert Install SSL Cert","description":"DigiCert. (n.d.). How to Install an SSL Certificate. Retrieved April 19, 2021.","url":"https://www.digicert.com/kb/ssl-certificate-installation.htm"},{"source_name":"Gallagher 2015","description":"Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”. Retrieved January 25, 2016.","url":"http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/"},{"source_name":"Malwarebytes Heroku Skimmers","description":"Jérôme Segura. (2019, December 4). There's an app for that: web skimmers found on PaaS Heroku. Retrieved August 18, 2022.","url":"https://www.malwarebytes.com/blog/news/2019/12/theres-an-app-for-that-web-skimmers-found-on-paas-heroku"},{"source_name":"Dragos Heroku Watering Hole","description":"Kent Backman. (2021, May 18). When Intrusions Don’t Align: A New Water Watering Hole and Oldsmar. Retrieved August 18, 2022.","url":"https://www.dragos.com/blog/industry-news/a-new-water-watering-hole/"},{"source_name":"FireEye CFR Watering Hole 2012","description":"Kindlund, D. (2012, December 30). CFR Watering Hole Attack Details. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20201024230407/https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html"},{"source_name":"Malwarebytes Silent Librarian October 2020","description":"Malwarebytes Threat Intelligence Team. (2020, October 14). Silent Librarian APT right on schedule for 20/21 academic year. Retrieved February 3, 2021.","url":"https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"},{"source_name":"Proofpoint TA407 September 2019","description":"Proofpoint Threat Insight Team. (2019, September 5). Threat Actor Profile: TA407, the Silent Librarian. Retrieved February 3, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"}],"platforms":["PRE"],"environments":["external-services"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1608.001","id":"T1608.001","name":"Upload Malware","page":"techniques/enterprise/T1608.001/"},{"key":"enterprise/T1608.002","id":"T1608.002","name":"Upload Tool","page":"techniques/enterprise/T1608.002/"},{"key":"enterprise/T1608.003","id":"T1608.003","name":"Install Digital Certificate","page":"techniques/enterprise/T1608.003/"},{"key":"enterprise/T1608.004","id":"T1608.004","name":"Drive-by Target","page":"techniques/enterprise/T1608.004/"},{"key":"enterprise/T1608.005","id":"T1608.005","name":"Link Target","page":"techniques/enterprise/T1608.005/"},{"key":"enterprise/T1608.006","id":"T1608.006","name":"SEO Poisoning","page":"techniques/enterprise/T1608.006/"},{"key":"enterprise/T1608.007","id":"T1608.007","name":"AI Result Poisoning","page":"techniques/enterprise/T1608.007/"}],"telemetry":[{"id":"DC0104","name":"Response Content","page":"telemetry/DC0104/","kind":"attack_component","category":"Network and protocol telemetry","description":"Content returned by a queried service, such as an HTTP response body or banner.","collection_focus":"Capture responses only from authorized lab services or approved datasets; retain request context, response hash and a sanitized bounded excerpt.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["service","response_excerpt","content_type","body_truncated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1608","id":"T1608","name":"Stage Capabilities","domain":"enterprise","platforms":["PRE"],"environments":["external-services"],"source_url":"https://attack.mitre.org/techniques/T1608","technique_page":"techniques/enterprise/T1608/","page":"detections/enterprise/T1608/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"00d49ed5-4491-4271-a8db-650a4ef6f8c1","title":"Suspicious Download from Office Domain","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/00d49ed5-4491-4271-a8db-650a4ef6f8c1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ac8866c7-ce44-46fd-8c17-b24acff96ca8","title":"HybridConnectionManager Service Installation - Registry","status":"test","level":"high","logsource":{"category":"registry_event","product":"windows"},"data_path":"data/detection-rules/ac8866c7-ce44-46fd-8c17-b24acff96ca8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1608-1","technique_id":"T1608","title":"T1608 Stage Capabilities","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#resource-development","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":36,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L36","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"ca6543243f495a1c89a48a262c73648c6225b8d21f7342134cf2113e9cfcf272","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(download_hash OR url OR sender IN known_malicious_indicators) -> ALERT","log_sources":[{"title":"Proxy and Secure Web Gateway Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#66-proxy-and-secure-web-gateway-logs"},{"title":"Email Gateway Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#72-email-gateway-logs"},{"title":"Content Inspection and Malware Scanning Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#101-content-inspection-and-malware-scanning-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0839","name":"Detection of Stage Capabilities","url":"https://attack.mitre.org/detectionstrategies/DET0839","stix_id":"x-mitre-detection-strategy--5a1ada5b-5729-45d5-8b3d-f6fa7d2a3352","relationship_id":"relationship--d5cb2afa-69f8-4705-9a19-5b1add24494a","description":"","analytics":[{"id":"AN1971","name":"Analytic 1971","guidance":"If infrastructure or patterns in malware, tooling, certificates, or malicious web content have been previously identified, internet scanning may uncover when an adversary has staged their capabilities.\nMuch of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle, such as initial access and post-compromise behaviors.","url":"https://attack.mitre.org/detectionstrategies/DET0839#AN1971","platforms":["PRE"],"tuning":[],"log_sources":[{"component_id":"DC0104","component":"Response Content","name":"Internet Scan","channel":"None","platforms":["PRE"],"analytic_id":"AN1971","source_url":"https://attack.mitre.org/detectionstrategies/DET0839#AN1971","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0104/"}]}]}],"telemetry_references":[{"id":"DC0104","name":"Response Content","tag":"Response Content","page":"telemetry/DC0104/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has used servers under their control to validate tracking pixels sent to phishing victims.(Citation: Proofpoint TA416 Europe March 2022)","relationship_id":"relationship--97b55f86-908f-4de2-ba9a-d65005b0f4dc","references":[{"source_name":"Proofpoint TA416 Europe March 2022","description":"Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}]}],"mitigations":[{"id":"M1056","name":"Pre-compromise","url":"https://attack.mitre.org/mitigations/M1056","kind":"course-of-action","description":"This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.","relationship_id":"relationship--e9baf508-6ac2-46b3-843e-d45974866af0","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1587":"/ttp-simulation/techniques/enterprise/T1587/","T1588":"/ttp-simulation/techniques/enterprise/T1588/","T1583":"/ttp-simulation/techniques/enterprise/T1583/","T1584":"/ttp-simulation/techniques/enterprise/T1584/","T1189":"/ttp-simulation/techniques/enterprise/T1189/","T1105":"/ttp-simulation/techniques/enterprise/T1105/","T1573.002":"/ttp-simulation/techniques/enterprise/T1573.002/","T1071.001":"/ttp-simulation/techniques/enterprise/T1071.001/","T1608":"/ttp-simulation/techniques/enterprise/T1608/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1608","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0104","collector":"illustrative-lab-collector","observation":{"service":"https://lab.example.test/health","response_excerpt":"LAB_OK","content_type":"text/plain","body_truncated":false}}]}}