Preparation phase staging: what defenders miss before alerts fire

TL;DR: Attack campaigns often begin weeks or months before any alert fires, according to Silent Push, because adversaries can register domains, provision servers, configure DNS, and test infrastructure while appearing indistinguishable from legitimate activity. Conventional threat intelligence therefore sees only the final stage of an offensive lifecycle, not the preparation work that creates it.

Editorial analysis by NHI Mgmt Group, based on content published by Silent Push: “What Is the Preparation Phase? The Part of the Attack Timeline Most Tools Miss”.

By the numbers:

• The average early-detection lead time from that process is 104 days ahead of a traditional SIEM alert.
• For Advanced Persistent Threat campaigns, the lead time has exceeded 300 days.

Key questions

Q: Why do SIEM and EDR miss preparation-phase attacks?

A: Because they are built around observable events, and preparation-phase infrastructure often exists before any malicious traffic, endpoint execution, or known-bad indicator appears.

Q: How can security teams identify malicious infrastructure before an incident starts?

A: They should look for linked infrastructure patterns rather than isolated indicators.

Q: What breaks when threat intelligence only tracks indicators of compromise?

A: It breaks on timing. IOC-only workflows begin after an asset has already been used maliciously, so they miss dormant infrastructure, test environments, and prepositioned servers. The result is an intelligence process that documents what happened instead of helping teams interrupt what is being prepared now.

Practitioner guidance

• Map detection coverage to attack lifecycle stage Separate controls that discover staging infrastructure from controls that detect active compromise.
• Hunt for infrastructure relationships, not single indicators Correlate DNS history, WHOIS lineage, certificate data, and hosting links to find staging clusters that look normal in isolation but suspicious in combination.
• Feed pre-breach signals into existing response workflows Push verified staging infrastructure into blocklists, case management, and SOC triage so analysts can act before a campaign becomes operational.

Bottom line: The core risk is not missed malware, but missed preparation, because adversaries can build and test infrastructure long before conventional tools produce a signal.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →