Techniques › T1074 › T1074.002
T1074.002 Remote Data Staging
collection — ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1074.002
0
KEV CVEs mapped here
<p>Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.</p><p>In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may Create Cloud Instance and stage data in that instance.</p><p>By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0071 Detection of Remote Data Staging Prior to Exfiltration v1.0
AN0194 WindowsDetects file transfers or mounting operations from remote hosts followed by write actions into a local staging directory, often using SMB or remote shell activity.Tunable:
StagingDirectoryRemotePathPatternsCopyToolPatternsAN0195 LinuxDetects inbound SCP, rsync, or NFS mounts from remote systems followed by aggregation of files into known staging paths like /mnt/staging or /var/tmp.Tunable:RemoteHostsMountTargetsTransferVolumeThresholdAN0196 macOSDetects rsync or scp inbound from other hosts that then aggregate content into /Users/Shared or /private/tmp, often involving compressed files or scripts.Tunable:StagingPathsCompressionIndicatorsTimeWindowAN0197 ESXiDetects remote writes or snapshots mounted from other systems into a central ESXi VMFS path or NFS store used for remote staging of files before exfiltration.Tunable:SnapshotFrequencyRemoteWriteVolumeStorageMountPathsAN0198 IaaSDetects remote write activity across cloud VMs or object storage buckets within the same region/account that correlate with data aggregation across hosts.Tunable:BucketNamePatternsIAMContextTransferWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1074.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1074) 2
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59
Various protocols maybe used to put data on the device for exfil or infil
Author: Austin Songer @austinsonger
· 2021-08-13 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 980a7598-1e7f-4962-9372-2d754c930d0e
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.