VOID MANTICOREG1055 ↗
Has staged compressed files in specified locations prior to exfiltration over C2.1
tfMITRE ATT&CK technique
Data Staged T1074
- Tactic
- Collection
- Platforms
- ESXi, IaaS, Linux, macOS, Windows
- Version
- 1.5
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Praetorian; Shane Tully, @securitygypsy
Sub-techniques 28 rules across the family · 3 mapped directly to T1074 · 1 of 2 carry rules
Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
5
Threat groups73rd pct
Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.Data Staged MITRE reference T1074
73rd pctamong all ATT&CK techniques for number of groups
5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
INC RansomG1032 ↗
Has staged data on compromised hosts prior to exfiltration.12
Volt TyphoonG1017 ↗
Has staged collected data in password-protected archives.1
Scattered SpiderG1015 ↗
Stages data in a centralized database prior to exfiltration.1
Wizard SpiderG0102 ↗
Has collected and staged credentials and network enumeration information, using the networkdll and psfin TrickBot modules.1
All 5 groups for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
QUIETCANARYS1076 ↗
Has the ability to stage data prior to exfiltration.1
KevinS1020 ↗
Can create directories to store logs and other collected data.1
SharkS1019 ↗
Has stored information in folders named U1 and U2 prior to exfiltration.1
KobalosS0641 ↗
Can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.1
All 4 software entries for this technique
Offense vs defense T1074
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1
first rule: 2019 Q3Data Staged detection strategy DET0014
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Data Staging Prior to Exfiltration
5 platforms
AN0040 · Windows
Detects staging of sensitive files into temporary or public directories, compression with 7zip/WinRAR, or batch copy prior to exfiltration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| StagingDirectoryList | Temp folders or user profile staging directories |
| CompressionToolList | 7z.exe, rar.exe, zip.exe paths |
| TimeWindow | Temporal bounds for detecting batch staging activities |
AN0041 · Linux
Detects script or user activity copying files to a central temp or /mnt directory followed by archive/compression utilities.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File CreationDC0039 | auditd:SYSCALL | creat |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| StagingDirectoryList | e.g., /tmp/, /var/tmp/, /mnt/ |
| ArchivingCommandPatterns | grep for 'tar', 'zip', 'gzip', '7z' |
| UserContext | Interactive or elevated shells running archiving commands |
AN0042 · macOS
Detects files collected into user temp or shared directories followed by compression with ditto, zip, or custom scripts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | exec logs |
| File AccessDC0055 | macos:unifiedlog | file events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CompressionUtilityList | e.g., 'ditto', 'zip', 'tar' |
| SharedDirectoryIndicators | e.g., /Users/Shared/ or /private/tmp/ |
| ScriptInvocationContext | osascript or Terminal automation by non-GUI processes |
AN0043 · IaaS
Detects virtual disk expansion or file copy operations to cloud buckets or mounted volumes from isolated instances.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Cloud Storage AccessDC0025 | AWS:CloudTrail | GetObject, CopyObject |
| File AccessDC0055 | gcp:audit | Write operations to storage |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CloudBucketList | Staging bucket or mount point for data |
| InstanceTag | Behavior restricted to specific ephemeral instances |
| ObjectWriteThreshold | Volume or size of files pushed in burst |
AN0044 · ESXi
Detects snapshots or data stored in VMFS volumes from root CLI or remote agents.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | esxi:vmkernel | VMFS access logs |
| Command ExecutionDC0064 | esxi:shell | snapshot create/copy, esxcli |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SnapshotFrequency | Number of snapshots in short time period |
| AccessUserList | Non-admins or automation accounts writing to datastores |
| CLIContext | Manual or unexpected API calls triggering snapshots |