Remote Data Staging (T1074.002) is the version of data staging where files from many machines are pulled to one chosen system. It sits in the collection tactic and applies to ESXi, IaaS, Linux, macOS and Windows.
How attackers use it
MITRE says adversaries may stage data collected from multiple systems in a central location or directory on one system before exfiltration. As with other staging, the data may stay as separate files or be combined, for example with archiving, and shell functions in cmd and bash can do the copying.
In cloud environments, an adversary may stage data in a particular instance or virtual machine, and may create a cloud instance for the purpose. MITRE gives the benefit to the adversary: fewer connections to their command and control server, which helps them avoid detection.
How to detect it
MITRE's strategy (DET0071) looks for the arrival of data from other hosts and then its aggregation:
- Windows: file transfers or mounts from remote hosts, often over SMB or remote shell, followed by writes into a local staging directory.
- Linux: inbound SCP, rsync or NFS mounts from remote systems, then aggregation into paths such as /mnt/staging or /var/tmp.
- macOS: inbound rsync or scp from other hosts, then content gathered into /Users/Shared or /private/tmp, often compressed.
- ESXi: remote writes or mounted snapshots from other systems into a central VMFS path or NFS store.
- Cloud: remote write activity across VMs or object storage buckets in the same region or account that lines up with data aggregation across hosts.
The useful question for a host is simple: why is this machine receiving files from so many others? A file server or backup target receives data by design, so build a baseline of which hosts do that.
How to reduce the risk
MITRE states that the technique cannot be easily mitigated with preventive controls, since it abuses system features. Defenders can narrow the ground by limiting which hosts may mount or write to one another, logging SMB, SCP and rsync sessions between workstations and servers, and keeping cloud storage write permissions scoped to the workloads that need them.
Quick check
What makes remote staging different from local staging?
Data comes from multiple systems and is gathered on one host, rather than being collected and kept on the single system the adversary is already on.
Sources
- MITRE ATT&CK, T1074.002 Remote Data Staging: https://attack.mitre.org/techniques/T1074/002/
