T1074.001sub-technique of T1074 Data Staged
Local Data Staging
ESXi · Linux · macOS · Windowsnothing on this site yetT1074.001 on attack.mitre.org
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspected data theft by an insider
A resignation with unusual file access, a DLP alert, or an unexplained large transfer.
how MITRE says to see it
Detection of Local Data Staging Prior to Exfiltration
- Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior.
- Detects aggregation of files from different directories into /tmp, /mnt, or user-specified directories with archiving tools like tar or gzip.
- Detects staged data aggregated in /Users/Shared, /private/tmp with compression tools like ditto or zip, initiated via Terminal or AppleScript.
- Detects local staging behavior via snapshot creation or files written into VMFS partitions by scripts or unauthorized shell access.