Techniques › T1074
T1074 Data Staged
collection — ESXi, IaaS, Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
2
Sigma rules tagged attack.t1074
0
KEV CVEs mapped here
<p>Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.</p><p>In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may Create Cloud Instance and stage data in that instance.</p><p>Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0014 Detection of Data Staging Prior to Exfiltration v1.0
AN0040 WindowsDetects staging of sensitive files into temporary or public directories, compression with 7zip/WinRAR, or batch copy prior to exfiltration.Tunable:
StagingDirectoryListCompressionToolListTimeWindowAN0041 LinuxDetects script or user activity copying files to a central temp or /mnt directory followed by archive/compression utilities.Tunable:StagingDirectoryListArchivingCommandPatternsUserContextAN0042 macOSDetects files collected into user temp or shared directories followed by compression with ditto, zip, or custom scripts.Tunable:CompressionUtilityListSharedDirectoryIndicatorsScriptInvocationContextAN0043 IaaSDetects virtual disk expansion or file copy operations to cloud buckets or mounted volumes from isolated instances.Tunable:CloudBucketListInstanceTagObjectWriteThresholdAN0044 ESXiDetects snapshots or data stored in VMFS volumes from root CLI or remote agents.Tunable:SnapshotFrequencyAccessUserListCLIContext
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1074
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59
Various protocols maybe used to put data on the device for exfil or infil
Author: Austin Songer @austinsonger
· 2021-08-13 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 980a7598-1e7f-4962-9372-2d754c930d0e
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.