VOID MANTICOREG1055 ↗
Has staged compressed files in specified locations prior to exfiltration over C2.1
tfMITRE ATT&CK technique
Data Staged T1074
- Tactic
- Collection
- Platforms
- ESXi, IaaS, Linux, macOS, Windows
- Version
- 1.5
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Praetorian; Shane Tully, @securitygypsy
Sub-techniques 28 rules across the family · 3 mapped directly to T1074 · 1 of 2 carry rules
Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.4
Tools & malware62nd pct
Tools & malware62nd percentile · 57% of ATT&CK techniques have fewer tools implementing them.3
Detection rules54th pct
Detection rules54th percentile · 49% of ATT&CK techniques have fewer detection rules written.