T1074.001Collection
Local Data Staging
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. Adversaries may also stage collected…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
4 Sigma rules tagged T1074.001Local Data StagingT1074.0014 general rules
- Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdletmediumtest
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Modulemediumtest
- Zip A Folder With PowerShell For Staging In Temp - PowerShellmediumtest
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Scriptmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Local Data Staging
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.