{"id":"T1074","name":"Data Staged","url":"https://attack.mitre.org/techniques/T1074","tactics":["collection"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0014","stix_id":"x-mitre-detection-strategy--11f7fa69-2da4-4280-90d2-abc2f0722683","name":"Detection of Data Staging Prior to Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0014","analytics":[{"id":"AN0040","stix_id":"x-mitre-analytic--7cb2010a-e502-4117-94f3-fa3bd8d64a34","name":"Analytic 0040","description":"Detects staging of sensitive files into temporary or public directories, compression with 7zip/WinRAR, or batch copy prior to exfiltration.","url":"https://attack.mitre.org/detectionstrategies/DET0014#AN0040","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"StagingDirectoryList","description":"Temp folders or user profile staging directories"},{"field":"CompressionToolList","description":"7z.exe, rar.exe, zip.exe paths"},{"field":"TimeWindow","description":"Temporal bounds for detecting batch staging activities"}],"live":true,"detection_strategies":["DET0014"],"techniques":["T1074"]},{"id":"AN0041","stix_id":"x-mitre-analytic--e9ee76c8-e959-4925-8f93-4b8fb66bc9f1","name":"Analytic 0041","description":"Detects script or user activity copying files to a central temp or /mnt directory followed by archive/compression utilities.","url":"https://attack.mitre.org/detectionstrategies/DET0014#AN0041","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"creat","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"StagingDirectoryList","description":"e.g., /tmp/, /var/tmp/, /mnt/"},{"field":"ArchivingCommandPatterns","description":"grep for 'tar', 'zip', 'gzip', '7z'"},{"field":"UserContext","description":"Interactive or elevated shells running archiving commands"}],"live":true,"detection_strategies":["DET0014"],"techniques":["T1074"]},{"id":"AN0042","stix_id":"x-mitre-analytic--313de6ca-629b-4f77-b58f-5cf7b490a62e","name":"Analytic 0042","description":"Detects files collected into user temp or shared directories followed by compression with ditto, zip, or custom scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0014#AN0042","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"file events","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"exec logs","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"CompressionUtilityList","description":"e.g., 'ditto', 'zip', 'tar'"},{"field":"SharedDirectoryIndicators","description":"e.g., /Users/Shared/ or /private/tmp/"},{"field":"ScriptInvocationContext","description":"osascript or Terminal automation by non-GUI processes"}],"live":true,"detection_strategies":["DET0014"],"techniques":["T1074"]},{"id":"AN0043","stix_id":"x-mitre-analytic--e622500c-4217-466c-955c-82ef3217653a","name":"Analytic 0043","description":"Detects virtual disk expansion or file copy operations to cloud buckets or mounted volumes from isolated instances.","url":"https://attack.mitre.org/detectionstrategies/DET0014#AN0043","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"GetObject, CopyObject","data_component":"DC0025","data_component_name":"Cloud Storage Access","log_source_slug":"aws-cloudtrail"},{"name":"gcp:audit","channel":"Write operations to storage","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"gcp-audit"}],"mutable_elements":[{"field":"CloudBucketList","description":"Staging bucket or mount point for data"},{"field":"InstanceTag","description":"Behavior restricted to specific ephemeral instances"},{"field":"ObjectWriteThreshold","description":"Volume or size of files pushed in burst"}],"live":true,"detection_strategies":["DET0014"],"techniques":["T1074"]},{"id":"AN0044","stix_id":"x-mitre-analytic--e59e2d8c-20cb-4a77-9d8b-1d838b01bd87","name":"Analytic 0044","description":"Detects snapshots or data stored in VMFS volumes from root CLI or remote agents.","url":"https://attack.mitre.org/detectionstrategies/DET0014#AN0044","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"VMFS access logs","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"esxi-vmkernel"},{"name":"esxi:shell","channel":"snapshot create/copy, esxcli","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"SnapshotFrequency","description":"Number of snapshots in short time period"},{"field":"AccessUserList","description":"Non-admins or automation accounts writing to datastores"},{"field":"CLIContext","description":"Manual or unexpected API calls triggering snapshots"}],"live":true,"detection_strategies":["DET0014"],"techniques":["T1074"]}],"live":true,"version":"1.0","techniques":["T1074"]}],"sigma_rules":[{"id":"5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59","title":"Cisco Stage Data","author":"Austin Clark","status":"test","level":"low","date":"2019-08-12","modified":"2023-01-04","description":"Various protocols maybe used to put data on the device for exfil or infil","references":[],"logsource":{"product":"cisco","service":"aaa"},"tags":["attack.collection","attack.lateral-movement","attack.command-and-control","attack.exfiltration","attack.t1074","attack.t1105","attack.t1560.001"],"path":"rules/network/cisco/aaa/cisco_cli_moving_data.yml","techniques":["T1074","T1105","T1560.001"],"cves":[]},{"id":"980a7598-1e7f-4962-9372-2d754c930d0e","title":"Google Full Network Traffic Packet Capture","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-13","modified":"2022-10-09","description":"Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.","references":["https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging","https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html"],"logsource":{"product":"gcp","service":"gcp.audit"},"tags":["attack.collection","attack.t1074"],"path":"rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml","techniques":["T1074"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}