tfMITRE ATT&CK sub-technique

Remote Data Staging T1074.002

Tactic: Collection
Platforms: ESXi, IaaS, Linux, macOS, Windows
Version: 1.2
Created: 13 March 2020
Last modified: 12 May 2026
Contributor: Praetorian

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 17%

Threat groups83rd percentile · 83% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Remote Data Staging MITRE reference T1074.002

Top 17%of all ATT&CK techniques for number of groups

11 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has gathered data and files of interest on a single victim machine.1

created 2026-04-171 referenceaka Earth Kasha

Sea TurtleG1041 ↗

Staged collected email archives in the public web directory of a website that was accessible from the internet.1

created 2024-11-201 referenceaka Teal Kurma

ToddyCatG1022 ↗

Manually transferred collected files to an exfiltration host using xcopy.1

created 2024-01-031 reference

MoustachedBouncerG1019 ↗

Has used plugins to save captured screenshots to .\AActdata\ on an SMB share.1

created 2023-09-251 reference

ChimeraG0114 ↗

Has staged stolen data on designated servers in the target environment.1

created 2020-08-241 reference

FIN8G0061 ↗

Aggregates staged data from a network into a single location.1

created 2018-04-181 referenceaka Syssphinx

All 11 groups for this technique · 6 newest in this preview

Offense vs defense T1074.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Remote Data Staging detection strategy DET0071

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Remote Data Staging Prior to Exfiltration

Enterprise

5 platforms

AN0194 · Windows

Detects file transfers or mounting operations from remote hosts followed by write actions into a local staging directory, often using SMB or remote shell activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Command ExecutionDC0064	WinEventLog:PowerShell	CommandLine=copy-item or robocopy from UNC path
Network Share AccessDC0102	WinEventLog:Microsoft-Windows-SMBClient/Security	EventCode=31001

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
StagingDirectory	Common directories such as C:\Temp, Downloads, or hidden folders used for remote staging
RemotePathPatterns	UNC paths like \\10.* or \\domain\share indicating lateral data staging
CopyToolPatterns	Usage of robocopy, xcopy, copy-item, or scheduled tasks performing cross-host copies

AN0195 · Linux

Detects inbound SCP, rsync, or NFS mounts from remote systems followed by aggregation of files into known staging paths like /mnt/staging or /var/tmp.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File AccessDC0055	auditd:SYSCALL	open
Network Traffic ContentDC0085	NSM:Flow	SSH logins or scp activity

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RemoteHosts	Expected inbound transfer hosts to filter normal activity from staging behavior
MountTargets	Directory destinations used as centralized locations
TransferVolumeThreshold	Threshold of transferred files or data volume over time

AN0196 · macOS

Detects rsync or scp inbound from other hosts that then aggregate content into /Users/Shared or /private/tmp, often involving compressed files or scripts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	exec logs
File CreationDC0039	macos:unifiedlog	file events
Network Traffic ContentDC0085	NSM:Flow	remote login and transfer

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
StagingPaths	Monitored remote-to-local write destinations such as /Users/Shared
CompressionIndicators	Presence of .zip, .7z, or tar.gz indicating consolidation
TimeWindow	Temporal correlation of transfer and staging write operations

AN0197 · ESXi

Detects remote writes or snapshots mounted from other systems into a central ESXi VMFS path or NFS store used for remote staging of files before exfiltration.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	esxi:vmkernel	VMFS file creation
Command ExecutionDC0064	esxi:shell	invoked remote scripts (esxcli)
Network Traffic ContentDC0085	esxi:vob	NFS/remote access logs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SnapshotFrequency	How often snapshots are mounted or restored from peer nodes
RemoteWriteVolume	Threshold for staging behavior vs. backup/operational activity
StorageMountPaths	Common local destinations for incoming data

AN0198 · IaaS

Detects remote write activity across cloud VMs or object storage buckets within the same region/account that correlate with data aggregation across hosts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Storage AccessDC0025	AWS:CloudTrail	GetObject, CopyObject
Process CreationDC0032	esxi:hostd	process execution across cloud VM
Network Traffic ContentDC0085	AWS:VPCFlowLogs	Traffic between instances

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BucketNamePatterns	Destination naming convention used for staging (e.g., temp-store)
IAMContext	IAM role or user performing multi-host write ops
TransferWindow	Burst of high-volume inter-VM transfers indicating staging

Remote Data Staging detections T1074.002

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs