{"id":"T1074.001","name":"Local Data Staging","url":"https://attack.mitre.org/techniques/T1074/001","tactics":["collection"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0261","stix_id":"x-mitre-detection-strategy--e91165c5-e850-465e-9042-6ba82478b522","name":"Detection of Local Data Staging Prior to Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0261","analytics":[{"id":"AN0724","stix_id":"x-mitre-analytic--561fb700-686a-4583-96a9-77a55358d357","name":"Analytic 0724","description":"Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0261#AN0724","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"StagingDirList","description":"Paths such as C:\\Temp, C:\\Windows\\Tasks, etc."},{"field":"ArchivingToolPatterns","description":"Matches to 7z.exe, rar.exe, zip.exe, or custom scripts."},{"field":"TimeWindow","description":"How long to correlate file reads followed by compression."}],"live":true,"detection_strategies":["DET0261"],"techniques":["T1074.001"]},{"id":"AN0725","stix_id":"x-mitre-analytic--c5e7b8a9-72f6-40db-be4a-ec17386d884f","name":"Analytic 0725","description":"Detects aggregation of files from different directories into /tmp, /mnt, or user-specified directories with archiving tools like tar or gzip.","url":"https://attack.mitre.org/detectionstrategies/DET0261#AN0725","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"StagingDirs","description":"e.g., /tmp, /var/tmp, custom user dirs"},{"field":"ArchiveUtilities","description":"tar, gzip, zip, 7z"},{"field":"UserThreshold","description":"Number of files or size written in short time"}],"live":true,"detection_strategies":["DET0261"],"techniques":["T1074.001"]},{"id":"AN0726","stix_id":"x-mitre-analytic--01a3cc24-df78-4ff7-8a25-67545d830229","name":"Analytic 0726","description":"Detects staged data aggregated in /Users/Shared, /private/tmp with compression tools like ditto or zip, initiated via Terminal or AppleScript.","url":"https://attack.mitre.org/detectionstrategies/DET0261#AN0726","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"file events","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"exec logs","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"StagingTargets","description":"Shared dirs commonly abused for local collection"},{"field":"CompressionBinaries","description":"zip, tar, ditto"},{"field":"TimeWindow","description":"Seconds/minutes between source file read and output staging write"}],"live":true,"detection_strategies":["DET0261"],"techniques":["T1074.001"]},{"id":"AN0727","stix_id":"x-mitre-analytic--27caeb90-1cf0-4650-a3f3-c8a1edaecbab","name":"Analytic 0727","description":"Detects local staging behavior via snapshot creation or files written into VMFS partitions by scripts or unauthorized shell access.","url":"https://attack.mitre.org/detectionstrategies/DET0261#AN0727","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"snapshot create/write events","data_component":"DC0057","data_component_name":"Snapshot Creation","log_source_slug":"esxi-vmkernel"},{"name":"esxi:shell","channel":"CLI usage logs","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"SnapshotThreshold","description":"Rapid creation or deletion of snapshots"},{"field":"CLIInvoker","description":"Unexpected CLI/script invocation outside maintenance windows"},{"field":"VMFSWriteRate","description":"Volume of data written locally in short time"}],"live":true,"detection_strategies":["DET0261"],"techniques":["T1074.001"]}],"live":true,"version":"1.0","techniques":["T1074.001"]}],"sigma_rules":[{"id":"71ff406e-b633-4989-96ec-bc49d825a412","title":"Zip A Folder With PowerShell For Staging In Temp - PowerShell","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2021-07-20","modified":"2023-12-18","description":"Detects PowerShell scripts that make use of the \"Compress-Archive\" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.\nAn adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md","https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a"],"logsource":{"product":"windows","service":"powershell-classic"},"tags":["attack.collection","attack.t1074.001"],"path":"rules/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml","techniques":["T1074.001"],"cves":[]},{"id":"85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98","title":"Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2021-07-20","modified":"2022-10-09","description":"Detects PowerShell scripts that make use of the \"Compress-Archive\" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.\nAn adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md","https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1074.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_zip_compress.yml","techniques":["T1074.001"],"cves":[]},{"id":"b7a3c9a3-09ea-4934-8864-6a32cacd98d9","title":"Zip A Folder With PowerShell For Staging In Temp - PowerShell Script","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2021-07-20","modified":"2023-12-18","description":"Detects PowerShell scripts that make use of the \"Compress-Archive\" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.\nAn adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md","https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.collection","attack.t1074.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml","techniques":["T1074.001"],"cves":[]},{"id":"daf7eb81-35fd-410d-9d7a-657837e602bb","title":"Zip A Folder With PowerShell For Staging In Temp  - PowerShell Module","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"medium","date":"2021-07-20","modified":"2023-12-18","description":"Detects PowerShell scripts that make use of the \"Compress-Archive\" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.\nAn adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md","https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.collection","attack.t1074.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml","techniques":["T1074.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}