Patchfirst
Patchfirst
T1608Resource Development

Stage Capabilities

Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the…

attack.mitre.org ↗
CVEs8
In 0
Reports0
Sub-techniques T1608.001Upload Malware11T1608.002Upload ToolT1608.003Install Digital CertificateT1608.004Drive-by TargetT1608.005Link TargetT1608.006SEO Poisoning

Detections

2 Sigma rules tagged T1608
Stage CapabilitiesT16082 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Stage Capabilities

8 CVEs, by priority. Each link shows its badge.
  1. CVE-2019-15288Cisco TelePresence Collaboration Endpoint, TelePresence Codec, and RoomOS Software Privilege Escalation Vulnerability
    Cisco · Cisco TelePresence TC SoftwareHigh · 8.8T1608Stage CapabilitiesT1078Valid Accounts+1 more
    MITRE CTID mapping of the CVE · primary impact
    1.7%Top 22%
    21.7priority
  2. CVE-2019-16009Cisco IOS and Cisco IOS XE Software Web UI Cross-Site Request Forgery Vulnerability
    Cisco · Cisco IOS 12.2(15)BHigh · 8.8T1608Stage CapabilitiesT1204.001Malicious Link
    MITRE CTID mapping of the CVE · primary impact
    1.0%Top 38%
    19.9priority
  3. CVE-2018-15466Cisco Policy Suite Graphite Unauthenticated Read-Only Access Vulnerability
    Cisco · Cisco Policy Suite (CPS) SoftwareMedium · 5.3T1608Stage CapabilitiesT1005Data from Local System
    MITRE CTID mapping of the CVE · primary impact
    1.9%Top 20%
    19.7priority
  4. CVE-2019-1768Cisco NX-OS Software Buffer Overflow and Command Injection Vulnerability
    Cisco · Cisco NX-OS SoftwareMedium · 6.7T1608Stage CapabilitiesT1078Valid Accounts+1 more
    MITRE CTID mapping of the CVE · primary impact
    1.0%Top 39%
    17.0priority
  5. CVE-2019-1857Cisco HyperFlex HX-Series Web-Based Management Interface Cross-Site Request Forgery Vulnerability
    Cisco · Cisco HyperFlex HX-SeriesMedium · 6.1T1608Stage CapabilitiesT1204.001Malicious Link
    MITRE CTID mapping of the CVE · primary impact
    0.6%Top 52%
    15.3priority
  6. CVE-2019-1781Cisco FXOS and NX-OS Software Command Injection Vulnerability
    Cisco · Cisco NX-OS SoftwareMedium · 6.7T1608Stage CapabilitiesT1078Valid Accounts+1 more
    MITRE CTID mapping of the CVE · primary impact
    0.5%Top 60%
    12.7priority
  7. CVE-2018-15401Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability
    Cisco · Cisco Hosted Collaboration Mediation FulfillmentT1608Stage CapabilitiesT1204.001Malicious Link
    MITRE CTID mapping of the CVE · primary impact
    0.5%Top 57%
    9.9priority
  8. CVE-2020-3379Cisco SD-WAN Solution Software Privilege Escalation Vulnerability
    Cisco · Cisco SD-WAN SolutionMedium · 5.3T1608Stage CapabilitiesT1078Valid Accounts
    MITRE CTID mapping of the CVE · primary impact
    0.4%Top 71%
    9.5priority

Linked through a sub-technique

11 more
  1. CVE-2021-44228Apache Log4j2 Remote Code Execution Vulnerability
    Apache · Log4j2KEVRansomwarePublic exploitCritical · 10.0T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 10 reports
    >99.9%Top 0.01%
    90.0priority
  2. CVE-2019-0604Microsoft SharePoint Remote Code Execution Vulnerability
    Microsoft · SharePointKEVRansomwarePublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+3 more · 4 reports
    99.9%Top 0.03%
    88.8priority
  3. CVE-2024-20353Cisco ASA and FTD Denial of Service Vulnerability
    Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)KEVPublic exploitHigh · 8.6T1608.001Upload MalwareT1190Exploit Public-Facing Application+2 more · 2 reports
    69.8%Top 0.63%
    85.0priority
  4. CVE-2025-32756Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability
    Fortinet · Multiple ProductsKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1133External Remote Services+5 more
    30.9%Top 1.7%
    79.5priority
  5. CVE-2024-37085VMware ESXi Authentication Bypass Vulnerability
    VMware · ESXiKEVRansomwarePublic exploitHigh · 7.2T1608.001Upload MalwareT1078Valid Accounts+1 more
    26.8%Top 2%
    77.6priority
  6. CVE-2023-33246Apache RocketMQ Command Execution Vulnerability
    Apache · RocketMQKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1190Exploit Public-Facing Application+1 more
    96.6%Top 0.12%
    69.8priority
  7. CVE-2024-54085AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability
    AMI · MegaRAC SPxKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1068Exploitation for Privilege Escalation+3 more
    60.7%Top 0.85%
    69.7priority
  8. CVE-2025-4632Samsung MagicINFO 9 Server Path Traversal Vulnerability
    Samsung · MagicINFO 9 ServerKEVPublic exploitCritical · 9.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+2 more
    24.1%Top 2.2%
    69.4priority
  9. CVE-2025-32706Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 more
    2.3%Top 16%
    65.2priority
  10. CVE-2025-32709Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 more
    1.8%Top 21%
    64.2priority
  11. CVE-2025-32701Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
    Microsoft · WindowsKEVHigh · 7.8T1608.001Upload MalwareT1059Command and Scripting Interpreter+3 more
    1.4%Top 27%
    58.0priority
↑ ↓ chooseEnter openEsc close