Preparation Phase

What the preparation phase does

The preparation phase is the quiet build-out period before an intrusion becomes operational. Adversaries use it to assemble the infrastructure, access paths, and test conditions they will rely on later, which makes the activity easy to miss if defenders only watch for live exploitation.

This phase matters because the work can look like ordinary internet administration. Domain registration, server provisioning, DNS changes, staging hosts, and test traffic may all be legitimate on their own, so the security value comes from seeing them as part of an emerging campaign rather than isolated events.

Common preparation activities

Preparation typically includes a mix of public-facing and behind-the-scenes setup. Attackers may register lookalike domains, provision servers for command, control, or delivery, configure DNS so traffic resolves cleanly, and verify that the infrastructure works before they use it at scale.

Testing is especially important because it helps the operator reduce friction once the campaign starts. A prepared environment can also support fallback paths, redundancy, and rotation of infrastructure, which makes the eventual operation more resilient and harder to disrupt.

Why this stage is dangerous

The danger of the preparation phase is that defenders often see low-signal activity that blends into normal operations. By the time the activity becomes clearly malicious, the supporting infrastructure may already be in place and ready to use.

That creates a narrow detection window. If preparation is not identified early, organizations may only discover the campaign when phishing, malware delivery, credential abuse, or other operational stages are already underway.

One useful way to think about this phase is as the adversary's setup layer: it is not the attack itself, but it materially shapes how the attack will work and how hard it will be to stop.

How defenders should interpret it

Preparation-phase activity is best treated as an early warning signal, especially when several small events cluster around the same actor, domain, network range, or hosting pattern. Individual actions may be benign, but the combination can indicate that infrastructure is being assembled for a later campaign.

For that reason, defenders should correlate registration, hosting, DNS, certificate, and traffic observations with other threat indicators rather than judging each event in isolation. A broader view is often what turns routine-looking setup into actionable threat intelligence.

Risk and Threat Considerations

Preparation activity is risky because it gives adversaries time to build reliable delivery infrastructure before any overt attack begins. It also creates a trust problem for defenders, since the same mechanics used for ordinary administration can be repurposed for staging malicious operations.

Failure mechanism: Security teams miss the campaign's setup signals, such as new domains, fresh servers, or unusual DNS patterns, and the attacker is able to transition from preparation to execution without interruption.

Impact: The organization loses early detection time, which increases the likelihood that phishing, malware delivery, or follow-on compromise will succeed at full operational speed.</p

Related resources from NHI Mgmt Group

• How should security teams automate the preparation phase of DFIR without losing control of the response process?
• How should security teams phase out password-based authentication without disrupting operations?
• How should security teams phase out SMS OTP without breaking access?
• When should teams move from target-phase controls to advanced OT Zero Trust controls?