Stage Capabilities `T1608`

Tactic: Resource Development

Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Capabilities may also be staged on web services, such as GitHub or Pastebin, or on Platform-as-a-Service (PaaS) offerings that enable users to easily provision applications.

Events covered

8 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 11	FileCreate
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4688	A new process has been created.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

These 14 rules share fields, values, and exclusions.

Fields filtered most (19 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	4	`eq` 4	`filemalwaredetected`, `createtopic`, `setvalue`
`data_stream.dataset`	4	`eq` 4	`o365.audit`, `aws.cloudtrail`, `azure.activitylogs`
`CommandLine`	3	`contains` 3	`-classpath` , `-shared`, `-wl,-init,`, `.downloadfile(`, `.downloadstring(`
`EventID`	3	`eq` 3	`sharepointfileoperation`, `4104`
`Provider_Name`	3	`eq` 3	`onedrive`, `sharepoint`, `sns.amazonaws.com`
`Image`	2	`ends_with` 2	`\\atlassian\\confluence\\jre\\bin\\java.exe`, `\curl.exe`, `\wget.exe`
`event.outcome`	2	`eq` 2	`success`
`process_name`	2	`in` 2	`x86_64-linux-gnu-gcc`, `cc`, `g++`, `northstarstager.exe`, `systemhealthcheck.exe`
`Details`	1	`contains` 1	`microsoft.hybridconnectionmanager.listener.exe`
`OriginalFileName`	1	`eq` 1	`northstarstager.exe`
`ScriptBlockText`	1	`ends_with` 1	`));iex (new-object io.streamreader(new-object...`
`TargetFilename`	1	`contains` 1, `in` 1	`.bat`, `.cmd`, `*.dat`
`TargetObject`	1	`contains` 1	`\services\hybridconnectionmanager`
`aws::eventName`	1	`eq` 1	`deleteimportedkeymaterial`, `importkeymaterial`
`aws::eventSource`	1	`eq` 1	`kms.amazonaws.com`

Top indicator values (61 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventID`	`eq`	`sharepointfileoperation` elasticM365 OneDrive Malware File Upload elasticM365 SharePoint Malware File Detected	2	2
`EventID`	`eq`	`4104` splunkWindows Cobalt Strike PowerShell Loader	1	269
`EventType`	`eq`	`filemalwaredetected` elasticM365 OneDrive Malware File Upload elasticM365 SharePoint Malware File Detected	2	2
`EventType`	`eq`	`createtopic` elasticAWS SNS Topic Created by Rare User	1
`EventType`	`eq`	`setvalue` sigmaHybridConnectionManager Service Installation - Registry	1	6
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 OneDrive Malware File Upload elasticM365 SharePoint Malware File Detected	2	47
`event.outcome`	`eq`	`success` elasticAWS SNS Topic Created by Rare User elasticAzure Automation Webhook Created	2	369
`CommandLine`	`contains`	`-classpath` splunkWindows Metasploit Confluence Plugin Execution	1	2
`CommandLine`	`contains`	`-shared` splunkLinux Suspicious GCC Invocation Building Init Shared Object	1
`CommandLine`	`contains`	`-wl,-init,` splunkLinux Suspicious GCC Invocation Building Init Shared Object	1
`CommandLine`	`contains`	`.downloadfile(` sigmaSuspicious Download from Office Domain	1	8
`CommandLine`	`contains`	`.downloadstring(` sigmaSuspicious Download from Office Domain	1	8
`CommandLine`	`contains`	`.payload` splunkWindows Metasploit Confluence Plugin Execution	1	2
`CommandLine`	`contains`	`.so` splunkLinux Suspicious GCC Invocation Building Init Shared Object	1
`CommandLine`	`contains`	`\\appdata\\local\\temp\\~spawn` splunkWindows Metasploit Confluence Plugin Execution	1
`CommandLine`	`contains`	`curl` sigmaSuspicious Download from Office Domain	1	17
`CommandLine`	`contains`	`https://attachment.outlook.live.net/owa/` sigmaSuspicious Download from Office Domain	1
`CommandLine`	`contains`	`https://onenoteonlinesync.onenote.com/onenoteonlinesync/` sigmaSuspicious Download from Office Domain	1
`CommandLine`	`contains`	`invoke-webrequest` sigmaSuspicious Download from Office Domain	1	15
`CommandLine`	`contains`	`iwr` sigmaSuspicious Download from Office Domain	1	13
`CommandLine`	`contains`	`start-bitstransfer` sigmaSuspicious Download from Office Domain	1	5
`CommandLine`	`contains`	`wget` sigmaSuspicious Download from Office Domain	1	13
`Details`	`contains`	`microsoft.hybridconnectionmanager.listener.exe` sigmaHybridConnectionManager Service Installation - Registry	1
`Image`	`ends_with`	`\\atlassian\\confluence\\jre\\bin\\java.exe` splunkWindows Metasploit Confluence Plugin Execution	1
`Image`	`ends_with`	`\curl.exe` sigmaSuspicious Download from Office Domain	1	31
`Image`	`ends_with`	`\wget.exe` sigmaSuspicious Download from Office Domain	1	9
`OriginalFileName`	`eq`	`northstarstager.exe` splunkWindows NorthStar C2 Agent Execution	1
`Provider_Name`	`eq`	`onedrive` elasticM365 OneDrive Malware File Upload	1	2
`Provider_Name`	`eq`	`sharepoint` elasticM365 SharePoint Malware File Detected	1
`Provider_Name`	`eq`	`sns.amazonaws.com` elasticAWS SNS Topic Created by Rare User	1	3

Stage Capabilities `T1608`

Events covered

Authoring guide

Fields filtered most (19 distinct)

Top indicator values (61 distinct)

Rules under this technique

Sigma 3 rules

Elastic 4 rules

Splunk 5 rules

Panther 2 rules

Stage Capabilities T1608

Events covered

Authoring guide

Fields filtered most (19 distinct)

Top indicator values (61 distinct)

Rules under this technique

Sigma 3 rules

Elastic 4 rules

Splunk 5 rules

Panther 2 rules

Stage Capabilities `T1608`