Stage Capabilities (T1608) belongs to the Resource Development tactic, and its platform is listed as PRE, meaning it happens before the adversary touches your environment. It has seven sub-techniques, from uploading malware to poisoning AI search results.
The technique is the step between building or buying a capability and using it. The adversary uploads, installs or sets up tools, malware or web content so they are ready when the attack begins.
How attackers use it
Per MITRE, an adversary takes capabilities they developed or obtained and stages them on infrastructure they control, either bought, rented or compromised. They may also use web services such as GitHub or Pastebin, or Platform-as-a-Service offerings that make it easy to stand up an application.
MITRE lists several things staging can support:
- Web resources for a drive-by compromise when a user browses to a site.
- Web resources for a link target used in spearphishing.
- Malware or tools placed where a victim network can fetch them, enabling Ingress Tool Transfer.
- An SSL/TLS certificate installed to encrypt command and control traffic.
One example on the page: Mustang Panda has used servers under its control to validate tracking pixels sent to phishing victims.
How to detect it
MITRE is direct that most of this takes place outside the target organization's visibility, which makes detection hard. If infrastructure or patterns in malware, tooling, certificates or malicious web content have been identified before, internet scanning may reveal staged capabilities.
For most teams the realistic move is to watch the stages that follow: how users reach links, what gets downloaded into your network, and which outbound connections look new. Each sub-technique page in this series covers its own related behaviors.
How to reduce the risk
MITRE's mitigation entry says this technique cannot easily be mitigated with preventive controls, because it relies on behaviors performed outside the scope of enterprise defenses. The practical response is to harden the later steps: control what users can download and run, filter email links, and inspect the software and packages you pull in.
Quick check
Why is Stage Capabilities hard to detect?
It happens on adversary infrastructure or third-party services, outside the target's telemetry. Detection is more realistic at the later stages such as initial access or tool transfer.
