- AN0194 · Analytic 0194 — Detects file transfers or mounting operations from remote hosts followed by write actions into a local staging directory, often using SMB or remote shell activity.
- AN0195 · Analytic 0195 — Detects inbound SCP, rsync, or NFS mounts from remote systems followed by aggregation of files into known staging paths like /mnt/staging or /var/tmp.
- AN0196 · Analytic 0196 — Detects rsync or scp inbound from other hosts that then aggregate content into /Users/Shared or /private/tmp, often involving compressed files or scripts.
- AN0197 · Analytic 0197 — Detects remote writes or snapshots mounted from other systems into a central ESXi VMFS path or NFS store used for remote staging of files before exfiltration.
- AN0198 · Analytic 0198 — Detects remote write activity across cloud VMs or object storage buckets within the same region/account that correlate with data aggregation across hosts.
AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Remote Data Staging
Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may Create Cloud Instance and stage data in that instance. By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging. Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as Windows Management Instrumentation and PowerShell.
Observed actors
Correlated CTI and IR reports
Cyber Knowledge context
Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.
Infrastructure as code, CI/CD, artifact provenance, and policy as code
Cloud Security · Governed topic match · 51/100Module 4 — Collection Sources
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100Endpoint live response and volatile acquisition
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Module 5 — Threat hunting
Blue Team & Defensive Security · Tactic learning route · 24/100
Cloud Security · Governed topic match · 51/100Module 4 — Collection Sources
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100Endpoint live response and volatile acquisition
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100Module 5 — Threat hunting
Blue Team & Defensive Security · Tactic learning route · 24/100
MITRE mitigations
No ATT&CK mitigation relationship is published for this technique. Apply risk-based controls and verify scope.