value: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](T1587)) or obtained ([Obtain Capabilities](T1588)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](T1583)) or was otherwise compromised by them ([Compromise Infrastructure](T1584)). Capabilities can also be staged on web services, such as GitHub or Pastebin.(Citation: Volexity Ocean Lotus November 2020)
  
  Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):
  
  * Staging web resources necessary to conduct [Drive-by Compromise](T1189) when a user browses to a site.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015)(Citation: ATT ScanBox)
  * Staging web resources for a link target to be used with spearphishing.(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)
  * Uploading malware or tools to a location accessible to a victim network to enable [Ingress Tool Transfer](T1105).(Citation: Volexity Ocean Lotus November 2020)
  * Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: [Asymmetric Cryptography](T1573.002) with [Web Protocols](T1071.001)).(Citation: DigiCert Install SSL Cert)
name: Stage Capabilities