T1608 Stage Capabilities
Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](https://attack.mitre.org/techniques/T1587)) or obtained ([Obtain Capabilities](https://attack.mitre.org/techniques/T1588)) and stage them on infrastructure under their control. These…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HybridConnectionManager Service Installation - Registryhightest · windows
- Suspicious Download from Office Domainhightest · windows
- AWS KMS Imported Key Material Usagehighexperimental · aws
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.