MITRE ATT&CKsub-technique

T1074.001 Local Data Staging

Published 2020-03-13 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
ESXi, Linux, macOS, Windows
Version
1.2
Created
2020-03-13

Description

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1074 Data Staged technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (144)

  • S9064 TRUSTTRAP software (malware)
  • S9065 DCSYNCER.SLICK software (malware)
  • S9058 SIGHTGRAB software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9035 LAMEHUG software (malware)
  • S9036 LP-Notes software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • S9020 LODEINFO software (malware)
  • S9022 MirrorStealer software (malware)
  • S9013 DRYHOOK software (malware)
  • S9010 GlassWorm software (malware)
  • S1246 BeaverTail software (malware)
  • S1245 InvisibleFerret software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • S1233 PAKLOG software (malware)
  • S1235 CorKLOG software (malware)
  • S1222 RIFLESPINE software (malware)
  • G1048 UNC3886 group
  • S1213 Lumma Stealer software (malware)
  • S1210 Sagerunex software (malware)
  • G1046 Storm-1811 group
  • C0051 APT28 Nearest Neighbor Campaign campaign
  • C0049 Leviathan Australian Intrusions campaign
  • S1196 Troll Stealer software (malware)
  • C0048 Operation MidnightEclipse campaign
Show all 144 ›

References