Description
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.
Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
Platforms
Threat Groups (28)
| ID | Group | Context |
|---|---|---|
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has stored collected data in a .tmp file.(Citation: Symantec WastedLocker June 2020) |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.(Citation... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has been known to stage files for exfiltration in a single location.(Citation: aptsim) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has staged collected data files under <code>C:\Program Files\Common Files\System\Ole DB\</code>.(Cita... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has saved stolen files including the `ntds.dit` database and the `SYSTEM` and `SECURITY` Registr... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) copied all targeted files to a directory called index that was eventually uploaded to the C&C serve... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has created a directory named "out" in the user's %AppData% folder and copied files to it.(Citation... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.(Citation: ... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has stored a decoy PDF file within a victim's `%temp%` folder.(Citation: Talos MuddyWater Jan 2022... |
| G1046 | Storm-1811 | [Storm-1811](https://attack.mitre.org/groups/G1046) has locally staged captured credentials for subsequent manual exfiltration.(Citation: rapid7-email... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has aggregated collected credentials in text files before exfiltrating.(Citation: Cisco Talos Intelli... |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has collected stolen files in a temporary folder in preparation for exfiltration.(Citation: ATT Si... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has stored collected credential files in <code>c:\windows\temp</code> prior to exfiltration. [M... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has utilized tools to aggregate data prior to exfiltration.(Citation: FBI FLASH APT39 September 2020) |
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has staged captured credentials in `var/log/ldapd<unique_keyword>.2.gz`.(Citation: Google Cloud Mand... |
| G0065 | Leviathan | [Leviathan](https://attack.mitre.org/groups/G0065) has used C:\Windows\Debug and C:\Perflogs as staging directories.(Citation: FireEye Periscope March... |
| G0053 | FIN5 | [FIN5](https://attack.mitre.org/groups/G0053) scripts save memory dump data into a specific directory on hosts in the victim environment.(Citation: Ma... |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has locally staged compressed and archived data for follow-on exfiltration.(Citation: Cisco Lot... |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has staged stolen data locally on compromised hosts.(Citation: NCC Group Chimera January 2021) |
| G0135 | BackdoorDiplomacy | [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has copied files of interest to the main drive's recycle bin.(Citation: ESET BackdoorDiplom... |
Associated Software (95)
| ID | Name | Type | Context |
|---|---|---|---|
| S0343 | Exaramel for Windows | Malware | [Exaramel for Windows](https://attack.mitre.org/software/S0343) specifies a path to store files scheduled for exfiltration.(Citation: ESET TeleBots Oc... |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) can collect data from the victim and stage it in <code>LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp</cod... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine.(Cit... |
| S1154 | VersaMem | Malware | [VersaMem](https://attack.mitre.org/software/S1154) staged captured credentials locally at `/tmp/.temp.data`.(Citation: Lumen Versa 2024) |
| S1233 | PAKLOG | Malware | [PAKLOG](https://attack.mitre.org/software/S1233) has stored the captured data in a file located `C:\\Users\\Public\\Libraries\\record.txt`.(Citation:... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used tmp files to stage gathered information.(Citation: TrendMicro Ursnif Mar 2015) |
| S0503 | FrameworkPOS | Malware | [FrameworkPOS](https://attack.mitre.org/software/S0503) can identifiy payment card track data on the victim and copy it to a local file in a subdirect... |
| S1245 | InvisibleFerret | Malware | [InvisibleFerret](https://attack.mitre.org/software/S1245) has staged data in consolidated folders prior to exfiltration.(Citation: ESET Contagious In... |
| S0629 | RainyDay | Malware | [RainyDay](https://attack.mitre.org/software/S0629) can use a file exfiltration tool to copy files to <code>C:\ProgramData\Adobe\temp</code> prior to ... |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) can stage files in a central location prior to exfiltration.(Citation: Malwarebytes Kimsuky June ... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) has the ability to write collected data to a file created in the <code>./LOGS</code> directory.(Cit... |
| S9022 | MirrorStealer | Malware | [MirrorStealer](https://attack.mitre.org/software/S9022) has stored stolen credentials on the local machine in `%TEMP%\31558.txt`.(Citation: ESET Mirr... |
| S0647 | Turian | Malware | [Turian](https://attack.mitre.org/software/S0647) can store copied files in a specific directory prior to exfiltration.(Citation: ESET BackdoorDiploma... |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) stores files and logs in a folder on the local drive.(Citation: ESET Machete July 2019)(Citation: C... |
| S1012 | PowerLess | Malware | [PowerLess](https://attack.mitre.org/software/S1012) can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\... |
| S0113 | Prikormka | Malware | [Prikormka](https://attack.mitre.org/software/S0113) creates a directory, <code>%USERPROFILE%\AppData\Local\SKC\</code>, which is used to store collec... |
| S1060 | Mafalda | Malware | [Mafalda](https://attack.mitre.org/software/S1060) can place retrieved files into a destination directory.(Citation: SentinelLabs Metador Sept 2022) |
| S1029 | AuTo Stealer | Malware | [AuTo Stealer](https://attack.mitre.org/software/S1029) can store collected data from an infected host to a file named `Hostname_UserName.txt` prior t... |
| S0615 | SombRAT | Malware | [SombRAT](https://attack.mitre.org/software/S0615) can store harvested data in a custom database under the %TEMP% directory.(Citation: BlackBerry Cost... |
| S0036 | FLASHFLOOD | Malware | [FLASHFLOOD](https://attack.mitre.org/software/S0036) stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB8... |
References
Frequently Asked Questions
What is T1074.001 (Local Data Staging)?
T1074.001 is a MITRE ATT&CK technique named 'Local Data Staging'. It belongs to the Collection tactic(s). Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such...
How can T1074.001 be detected?
Detection of T1074.001 (Local Data Staging) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1074.001?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1074.001?
Known threat groups using T1074.001 include: Indrik Spider, GALLIUM, APT3, Kimsuky, Volt Typhoon, Patchwork, Dragonfly, menuPass.