T1074
Data Staged
ESXi · IaaS · Linux · macOS · Windows1 piece on this siteT1074 on attack.mitre.org
Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Data theft extortion response plan: verify the claim, find the way out, own the notification
An extortion demand with nothing encrypted, or your name on a leak site. Three questions run in parallel with three owners: is the claim real, what left and how, and what you are obliged to say and to whom. A plan for answering each one on evidence rather than on the attacker's framing.
how MITRE says to see it
Detection of Data Staging Prior to Exfiltration
- Detects staging of sensitive files into temporary or public directories, compression with 7zip/WinRAR, or batch copy prior to exfiltration.
- Detects script or user activity copying files to a central temp or /mnt directory followed by archive/compression utilities.
- Detects files collected into user temp or shared directories followed by compression with ditto, zip, or custom scripts.
- Detects virtual disk expansion or file copy operations to cloud buckets or mounted volumes from isolated instances.