{"id":"T1608.001","name":"Upload Malware","url":"https://attack.mitre.org/techniques/T1608/001","tactics":["resource-development"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0824","stix_id":"x-mitre-detection-strategy--faa650c9-a469-45f1-870a-6acc448df9eb","name":"Detection of Upload Malware","url":"https://attack.mitre.org/detectionstrategies/DET0824","analytics":[{"id":"AN1956","stix_id":"x-mitre-analytic--4ef6c517-011e-4155-897f-e86cea5824b4","name":"Analytic 1956","description":"If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting.\nMuch of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as [User Execution](https://attack.mitre.org/techniques/T1204) or [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) .","url":"https://attack.mitre.org/detectionstrategies/DET0824#AN1956","platforms":["PRE"],"log_source_references":[{"name":"Internet Scan","channel":"None","data_component":"DC0104","data_component_name":"Response Content","log_source_slug":"internet-scan"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0824"],"techniques":["T1608.001"]}],"live":true,"version":"1.0","techniques":["T1608.001"]}],"sigma_rules":[],"kev_cves":[{"cveID":"CVE-2024-54085","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-4632","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-32756","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-32709","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32706","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2025-32701","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2024-37085","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-20353","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-33246","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44228","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2019-0604","state":"mapped","mapping_types":["primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}