Stage Capabilities: recognize the technique

Lesson Purpose

What you are learning

This technique is about preparing content, tools, or other resources on infrastructure so they are ready for later use. A hosted file, redirect, or newly configured service is not automatically malicious. Defenders should connect those preparation signs with later network or endpoint activity before drawing a conclusion.

Learning Objectives

Explain Stage Capabilities in plain language.
Identify evidence a defender could review.
Choose a defensive action that fits the observed behavior.

Why This Matters

Staging may appear in DNS, hosting, certificate, web, or threat-intelligence data before an organization sees delivery or execution. Once company systems contact the staged infrastructure, proxy, DNS, download, and endpoint logs can add stronger context.

OWASP Web Security Testing Guide (WSTG)

Use a repeatable web-testing method

Connect this ATT&CK training activity to the WSTG approach: establish expected behavior, identify the relevant attack surface, change one controlled input or observation at a time, compare the response with the baseline, and record evidence before drawing a conclusion.

For reconnaissance-oriented lessons such as T1595, treat reachability, exposed services, and observable application behavior as information gathering. A reachable service is evidence about exposure; it is not by itself proof of a vulnerability.

Open WSTG web security fundamentals

Exercise

Before You Practice

Practice Preparation

Use these lesson concepts for the ungraded practice activity below. You do not need outside research.

Staging may appear in DNS/hosting records, certificates, web observations, or threat-intelligence reporting.
A useful correlation connects external staging evidence with later organization-specific DNS, proxy, download, network, or endpoint activity.
Controls include filtering, egress restrictions, download/application controls, monitoring, and rapid blocking of validated malicious infrastructure.

This is ungraded practice. Use the lesson material above; exact wording is not required. Identify three sources that could reveal staged capabilities. Then give one useful correlation and two controls that reduce risk. No external target interaction is required. Use only the learner-facing material in this lesson and explain why each answer is relevant to a defender.

Knowledge Check

Check your understanding

Answer the questions shown below. You must answer at least 2 correctly before marking this concept lesson complete.

1. Which statement best describes Stage Capabilities? This technique is about preparing content, tools, or other resources on infrastructure so they are ready for later use. Acquire Access means getting access that already exists, such as an account or remote-access connection, instead of creating a new way into the target. This technique is about creating written, visual, audio, or other material that can support later targeting, impersonation, social engineering, or fraud.

2. A defender is investigating activity related to the behavior described in this lesson. Which evidence set would provide the most relevant context? Web-content changes, certificate and DNS changes, proxy and DNS logs, download records, and endpoint events Login logs, VPN records, new-device events, MFA changes, password resets, and activity after login Email headers, sender-authentication results, link destinations, attachment metadata, and recipient reports

3. Which interpretation best avoids overstating what the observed information proves? Staging is preparation. Strong conclusions come from connecting infrastructure changes with later contact or system activity. Valid credentials do not always mean valid use. Check the context around a successful login. Convincing content is not automatically authentic. Use independent verification and technical evidence.

4. Consider this behavior: This technique is about preparing content, tools, or other resources on infrastructure so they are ready for later use. A hosted file, redirect, or newly configured service is not automatically malicious. Which ATT&CK technique best matches the behavior? Stage Capabilities Acquire Access Generate Content

5. A defender wants to reduce or validate the risk described in this scenario. Which response is the most appropriate? Connect infrastructure changes with enterprise contact and later endpoint or network activity Compare the login with the user's normal device, source, and behavior, then review what happened after authentication Verify the claimed sender through a separate trusted channel and inspect the message's technical context

6. Which limitation should a defender keep in mind before drawing a conclusion from this evidence? A hosted file, redirect, or new service is not automatically malicious A successful login with valid credentials does not prove that the legitimate user performed it Polished or personalized content is not proof that it is genuine

Learning Moment

Staging is preparation. Strong conclusions come from connecting infrastructure changes with later contact or system activity.

Defender Perspective

Useful evidence includes new or changed web content, suspicious files or redirects, certificate and DNS changes, provider reports, threat intelligence, proxy logs, DNS logs, download records, and endpoint events. Check who owns the infrastructure, what changed, which company systems contacted it, and what happened afterward. Reduce risk with web and DNS filtering, download inspection, endpoint protection, and egress monitoring.

Continue Your Learning Pathway

Next Step · Web Security Fundamentals

You've learned how reconnaissance helps a tester understand a target. Next, learn how web applications process input and how testers recognize evidence of common vulnerabilities.

Complete this lesson first. Finish the required lesson activity and knowledge check, if present, before continuing.

Return to dashboard