T1074 · Data Staged

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1074 · Data Staged · Sunturai

attack-patternenterprise-attackT1074

Data Staged

attack-pattern--7dd95ff6-712e-4056-9626-312ea4ab4c5e

Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017) In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may Create Cloud Instance and stage data in that instance.(Citation: Mandiant M-Trends 2020) Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

2 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

17 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Potential OpenSSH Backdoor Logging Activity	Low	Elastic detection rules	Oct 9, 2026	Elastic License 2.0
Remote File Copy to a Hidden Share	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Exchange Mailbox Export via PowerShell	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive File Access followed by Compression	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Discovery Command Output Written to Suspicious File	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Google Workspace Drive Data Transfer or Takeout Export Initiated	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS EC2 Full Network Packet Capture Detected	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS RDS DB Instance Restored	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Data Encrypted via OpenSSL Utility	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Enumeration using Adfind Tool	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
User deletes items in bulk	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Netskope - Excessive Downloads Detection (Spike vs Baseline)	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Netskope - Data Movement Tracking (Upload/Download Monitoring)	Informational	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Netskope - Anomalous User Behavior (High Volume from Unmanaged Device)	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Suspicious SQLite3 LSQuarantine Behavior	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Cisco Stage Data	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Google Full Network Traffic Packet Capture	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 17 of 17

Filter in the catalogue

External references

mitre-attackT1074Open reference

Mandiant M-Trends 2020Open reference

PWC Cloud Hopper April 2017Open reference

Platforms

ESXiIaaSLinuxmacOSWindows

Kill chain phases

collection

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object