tfMITRE ATT&CK technique

Stage Capabilities T1608

Tactic: Resource Development
Platform: PRE
Version: 1.2
Created: 17 March 2021
Last modified: 24 October 2025

Sub-techniques 68 rules across the family · 6 mapped directly to T1608 · 3 of 6 carry rules

.001Upload Malware1 .002Upload Tool1 .003Install Digital Certificate1 .004Drive-by Target0 .005Link Target0 .006SEO Poisoning0

Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.[1][2][3][4][5]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules67th pct

Detection rules67th percentile · 64% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1608

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 4

Data component	Name	Channel
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Response ContentDC0104

Internet Scan

—

Offense vs defense T1608

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 4

Data component	Name	Channel
Response ContentDC0104	Internet Scan	—

Data component

Name

Channel

Response ContentDC0104

Internet Scan

—

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Resource Development Stage Capabilities	-	high	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2021-04-12	2022-11-27	ac8866c7-ce44-46fd-8c17-b24acff96ca8
Splunk	The following analytic detects compiler usage with flags commonly used to create shared libraries that auto-run initialization functions, which are often associated with local privilege escalation exploits.	Generic	stable	process_creation	linux	Sysmon	Privilege Escalation Exploitation for Privilege Escalation Stealth Obfuscated Files or Information Compile After Delivery Execution Shared Modules Resource Development Stage Capabilities	CVE-2025-32463	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	9dbf4a61-0493-43bd-932c-532ba7671a7a
	Detects suspicious ways to download files from Microsoft domains that are used to store attachments (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Resource Development Stage Capabilities	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2021-12-27	2022-08-02	00d49ed5-4491-4271-a8db-650a4ef6f8c1
Splunk	Detects the PowerShell pattern used at the end of a Cobalt Strike PowerShell loader to perform the decompression of the executable. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Resource Development Stage Capabilities	-	medium	Raven Tait, Splunk	2026-05-05	2026-05-13	a6351724-06dc-42dd-939f-679add826e76	-
Splunk	Detects the malicious java plugin execution used by metasploit for Atlassian Confluence exploitation. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Initial Access Exploit Public-Facing Application Persistence Server Software Component Web Shell Resource Development Stage Capabilities	-	medium	Raven Tait, Splunk	2021-09-02	2026-05-13	3a3d1f35-5985-4827-b2ad-965467303c59	-
Splunk	Detects the initial agent or persistent agent processes for Northstar C2 being run. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Resource Development Stage Capabilities Execution User Execution Malicious File	-	medium	Raven Tait, Splunk	2021-06-23	2026-05-13	5f13d5b2-5181-487b-89eb-e2b471522202

Title

Description

Stage Capabilities T1608

Stage Capabilities T1608

Stage Capabilities MITRE reference T1608

Offense vs defense T1608

Stage Capabilities detection strategy DET0839

Detection of Stage Capabilities

Log sources

Stage Capabilities MITRE reference T1608

Offense vs defense T1608

Stage Capabilities detection strategy DET0839

Detection of Stage Capabilities

Log sources

Stage Capabilities detections T1608

Stage Capabilities detections T1608