AML.T0079

MITRE ATLAS / Stage Capabilities

Adversaries upload, install, or otherwise position capabilities where they can be used during targeting, such as placing a poisoned model on a hub, hosting a malicious payload, or seeding a repository ahead of time.

Think of it likeHiding the ladder in the hedge days before the night you plan to use it.

In plain English

Attack tooling gets put in place before the attack. A poisoned model uploaded to a hub or a payload parked on a rented domain sits quietly until the moment it is needed.