Before data leaves a network, it often sits in one place first. MITRE ATT&CK calls this Data Staged (T1074), a collection technique that applies to ESXi, IaaS, Linux, macOS and Windows. It has two sub-techniques, local and remote staging, covered in their own guides.
How attackers use it
MITRE says adversaries may stage collected data in a central location or directory before exfiltration. The data may stay in separate files or be combined into one file, for example through archiving. Common shell features in cmd and bash can copy data into the staging location.
In cloud environments, an adversary may stage data inside a particular instance or virtual machine, and may create a new cloud instance to do it.
MITRE gives the reason: staging in one place lets an adversary make fewer connections to their command and control server, which makes detection harder.
How to detect it
MITRE's detection strategy for this technique (DET0014) is built around what staging looks like on each platform:
- Windows: sensitive files placed into temporary or public directories, compression with tools such as 7zip or WinRAR, or batch copy before exfiltration.
- Linux: scripts or users copying files into a central temp or /mnt directory, followed by archive utilities.
- macOS: files collected into user temp or shared directories, followed by compression with ditto, zip or custom scripts.
- IaaS: virtual disk expansion, or file copy operations to cloud buckets or mounted volumes from isolated instances.
- ESXi: snapshots or data stored in VMFS volumes by root CLI sessions or remote agents.
The pattern to watch is the sequence: many reads from many places, then writes to one place, then compression, then outbound traffic. Any one step is normal. The chain is not.
How to reduce the risk
MITRE states that this technique cannot be easily mitigated with preventive controls, since it is based on the abuse of system features. That puts the weight on detection and on limiting what is reachable.
Practical steps that follow from the detection guidance:
- Log file creation and archive tool execution in temp and shared directories, and alert on large archives made by unusual accounts.
- Watch cloud storage and new instance creation for volumes or buckets that suddenly collect data from many hosts.
- Limit broad read access so that one account cannot gather everything in one pass.
Quick check
Why do adversaries bother to stage data at all?
According to MITRE, it lets them minimize the number of connections to their command and control server, which helps them avoid detection.
Sources
- MITRE ATT&CK, T1074 Data Staged: https://attack.mitre.org/techniques/T1074/
