kevmap

Techniques › T1074 › T1074.001

T1074.001 Local Data Staging

collection — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
4
analytics
4
Sigma rules tagged attack.t1074.001
0
KEV CVEs mapped here
<p>Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.</p><p>Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1074.001

Zip A Folder With PowerShell For Staging In Temp - PowerShell mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2021-07-20 (modified 2023-12-18) · logsource: product=windows service=powershell-classic · 71ff406e-b633-4989-96ec-bc49d825a412
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Techniques: T1074.001
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2021-07-20 (modified 2022-10-09) · logsource: product=windows category=process_creation · 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Techniques: T1074.001
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2021-07-20 (modified 2023-12-18) · logsource: product=windows category=ps_script · b7a3c9a3-09ea-4934-8864-6a32cacd98d9
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Techniques: T1074.001
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2021-07-20 (modified 2023-12-18) · logsource: product=windows category=ps_module · daf7eb81-35fd-410d-9d7a-657837e602bb
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Techniques: T1074.001

Rules tagged at the parent level (attack.t1074) 2

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Cisco Stage Data lowtest
Author: Austin Clark · 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59
Various protocols maybe used to put data on the device for exfil or infil
Techniques: T1074T1105T1560.001
Google Full Network Traffic Packet Capture mediumtest
Author: Austin Songer @austinsonger · 2021-08-13 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 980a7598-1e7f-4962-9372-2d754c930d0e
Identifies potential full network packet capture in gcp. This feature can potentially be abused to read sensitive data from unencrypted internal traffic.
Techniques: T1074