TA0042 · RESOURCE DEVELOPMENT
Stage Capabilities
Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.
Detect it with
If infrastructure or patterns in malware, tooling, certificates, or malicious web content have been previously identified, internet scanning may uncover when an adversary has staged their capabilities.
Why it matters on shift
Stage Capabilities is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.
6 sub-techniques
How it shows up in practice
- T1608.001
Upload Malware
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content.
- T1608.002
Upload Tool
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial.
- T1608.003
Install Digital Certificate
Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems.
- T1608.004
Drive-by Target
Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise.
- T1608.005
Link Target
Adversaries may put in place resources that are referenced by a link that can be used during targeting.
- T1608.006
SEO Poisoning
Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims.
Kill-chain context