Stage Capabilities
Capability staging places tools or content where they can later support an operation.
What it means
Capability staging places tools or content where they can later support an operation. Observed preparation should be distinguished from delivery and execution against a target.
MITRE ATT&CK catalogs this behavior as T1608, within resource development. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A suspicious site hosts files later referenced in messages sent to the organization.
Evidence to examine
Review artifact identity, hosting relationships, availability timing, delivery references, and actual retrieval.
A common analytical pitfall
A staged artifact's availability does not show which recipients downloaded or executed it.
Response considerations
Preserve relevant content and relationships through authorized procedures and scope target-side impact using actual delivery and execution evidence.
Placement prepares a later action
A fictional investigation finds a malicious file available on a controlled download location before employees receive links to it. The placement is preparation for delivery or retrieval. It does not establish that a recipient downloaded the file, executed it, or experienced compromise. Those later events require their own evidence.
Staging can involve more than a single file. Supporting content and infrastructure may be arranged so an operation can use them at the intended time. The target organization may observe only the eventual request, while intelligence or hosting evidence provides a partial view of earlier preparation. State those visibility differences clearly.
Time and content relationships matter. A file at a URL can change, and a hash observed later may not represent what an earlier recipient received. Preserve relevant versions and timestamps through approved evidence-handling methods. Avoid assuming that a current download proves historical content.
Build a preparation-to-impact timeline
For a classroom exercise, create synthetic events for file placement, message delivery, download, and endpoint execution. Mark which events are confirmed and which are missing. Explain why a gap between download and execution should remain a gap rather than being filled by assumption.
Defensive controls may block corroborated staging locations or detect retrieval behavior, but shared hosting can create collateral effects. Scope any block to the evidence and review its continuing need. Do not retrieve or execute unknown content on a normal workstation. The useful lesson is that staged capability is one step in a longer sequence, and a good investigation preserves the distinction between readiness, delivery, use, and actual consequence.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1608: Stage Capabilities