Local Data Staging (T1074.001) is a sub-technique of Data Staged, in the collection tactic. It applies to ESXi, Linux, macOS and Windows. The word local matters: everything is gathered on the one system the adversary already controls.
How attackers use it
MITRE says adversaries may stage collected data in a central location or directory on the local system before exfiltration. Data may be kept as separate files or combined into one file, for example with archiving. Interactive shells and common functions in cmd and bash can do the copying.
MITRE adds that staging is not limited to plain folders. Adversaries may also use other formats and locations on a system, such as local storage databases and repositories, or the Windows Registry.
How to detect it
MITRE's strategy for this sub-technique (DET0261) describes one analytic per platform:
- Windows: file reads across several locations followed by writes to temp or staging directories, often compressed or encrypted.
- Linux: files from different directories aggregated into /tmp, /mnt or user-chosen directories with archiving tools such as tar or gzip.
- macOS: staged data in /Users/Shared or /private/tmp with compression tools like ditto or zip, started from Terminal or AppleScript.
- ESXi: snapshot creation, or files written into VMFS partitions by scripts or unauthorized shell access.
On Linux, a read-only look at the usual staging spots is a reasonable starting point:
ls -lat /tmp /var/tmp /mnt | head -40
Look for large archives or directories you do not recognize, and check who owns them.
How to reduce the risk
MITRE notes this technique cannot be easily mitigated with preventive controls because it abuses normal system features. Focus on visibility: file and process logging for temp and shared paths, alerts on archive tools run by unexpected accounts, and tight limits on what any single account can read.
Quick check
Where besides folders might data be staged locally?
MITRE lists local storage databases and repositories, and the Windows Registry.
Sources
- MITRE ATT&CK, T1074.001 Local Data Staging: https://attack.mitre.org/techniques/T1074/001/
