{"id":"T1074.002","name":"Remote Data Staging","url":"https://attack.mitre.org/techniques/T1074/002","tactics":["collection"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0071","stix_id":"x-mitre-detection-strategy--20f11806-1639-49c5-ae0b-84633a142870","name":"Detection of Remote Data Staging Prior to Exfiltration","url":"https://attack.mitre.org/detectionstrategies/DET0071","analytics":[{"id":"AN0194","stix_id":"x-mitre-analytic--7efd6a7b-d7c0-4922-a1df-c492c0a2d3f8","name":"Analytic 0194","description":"Detects file transfers or mounting operations from remote hosts followed by write actions into a local staging directory, often using SMB or remote shell activity.","url":"https://attack.mitre.org/detectionstrategies/DET0071#AN0194","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Microsoft-Windows-SMBClient/Security","channel":"EventCode=31001","data_component":"DC0102","data_component_name":"Network Share Access","log_source_slug":"wineventlog-microsoft-windows-smbclient-security"},{"name":"WinEventLog:PowerShell","channel":"CommandLine=copy-item or robocopy from UNC path","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"StagingDirectory","description":"Common directories such as C:\\Temp, Downloads, or hidden folders used for remote staging"},{"field":"RemotePathPatterns","description":"UNC paths like \\\\10.* or \\\\domain\\share indicating lateral data staging"},{"field":"CopyToolPatterns","description":"Usage of robocopy, xcopy, copy-item, or scheduled tasks performing cross-host copies"}],"live":true,"detection_strategies":["DET0071"],"techniques":["T1074.002"]},{"id":"AN0195","stix_id":"x-mitre-analytic--14ac0f26-e5db-42da-b730-9e115027f8e9","name":"Analytic 0195","description":"Detects inbound SCP, rsync, or NFS mounts from remote systems followed by aggregation of files into known staging paths like /mnt/staging or /var/tmp.","url":"https://attack.mitre.org/detectionstrategies/DET0071#AN0195","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"SSH logins or scp activity","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"RemoteHosts","description":"Expected inbound transfer hosts to filter normal activity from staging behavior"},{"field":"MountTargets","description":"Directory destinations used as centralized locations"},{"field":"TransferVolumeThreshold","description":"Threshold of transferred files or data volume over time"}],"live":true,"detection_strategies":["DET0071"],"techniques":["T1074.002"]},{"id":"AN0196","stix_id":"x-mitre-analytic--2891bd53-5a81-4330-bb05-ffd731868d06","name":"Analytic 0196","description":"Detects rsync or scp inbound from other hosts that then aggregate content into /Users/Shared or /private/tmp, often involving compressed files or scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0071#AN0196","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"exec logs","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"file events","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"remote login and transfer","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"StagingPaths","description":"Monitored remote-to-local write destinations such as /Users/Shared"},{"field":"CompressionIndicators","description":"Presence of .zip, .7z, or tar.gz indicating consolidation"},{"field":"TimeWindow","description":"Temporal correlation of transfer and staging write operations"}],"live":true,"detection_strategies":["DET0071"],"techniques":["T1074.002"]},{"id":"AN0197","stix_id":"x-mitre-analytic--0e2094fe-6912-4bde-9e5a-9d95c640646a","name":"Analytic 0197","description":"Detects remote writes or snapshots mounted from other systems into a central ESXi VMFS path or NFS store used for remote staging of files before exfiltration.","url":"https://attack.mitre.org/detectionstrategies/DET0071#AN0197","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"VMFS file creation","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"esxi-vmkernel"},{"name":"esxi:vob","channel":"NFS/remote access logs","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"esxi-vob"},{"name":"esxi:shell","channel":"invoked remote scripts (esxcli)","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"esxi-shell"}],"mutable_elements":[{"field":"SnapshotFrequency","description":"How often snapshots are mounted or restored from peer nodes"},{"field":"RemoteWriteVolume","description":"Threshold for staging behavior vs. backup/operational activity"},{"field":"StorageMountPaths","description":"Common local destinations for incoming data"}],"live":true,"detection_strategies":["DET0071"],"techniques":["T1074.002"]},{"id":"AN0198","stix_id":"x-mitre-analytic--696b98e8-10fd-4c7a-bb80-302baca34e60","name":"Analytic 0198","description":"Detects remote write activity across cloud VMs or object storage buckets within the same region/account that correlate with data aggregation across hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0071#AN0198","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"GetObject, CopyObject","data_component":"DC0025","data_component_name":"Cloud Storage Access","log_source_slug":"aws-cloudtrail"},{"name":"AWS:VPCFlowLogs","channel":"Traffic between instances","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"aws-vpcflowlogs"},{"name":"esxi:hostd","channel":"process execution across cloud VM","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"esxi-hostd"}],"mutable_elements":[{"field":"BucketNamePatterns","description":"Destination naming convention used for staging (e.g., temp-store)"},{"field":"IAMContext","description":"IAM role or user performing multi-host write ops"},{"field":"TransferWindow","description":"Burst of high-volume inter-VM transfers indicating staging"}],"live":true,"detection_strategies":["DET0071"],"techniques":["T1074.002"]}],"live":true,"version":"1.0","techniques":["T1074.002"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}