T1074.001 Local Data Staging — Attack Simulation

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Stage data from Discovery.bat
windows automated powershell
Procedure 107706a5-6f9f-451a-adae-bab8c667829f; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Stage data from Discovery.sh
linux macos automated sh
Procedure 39ce0303-ae16-4b9e-bb5b-4f53e8262066; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Zip a Folder with PowerShell for Staging in Temp
windows automated powershell
Procedure a57fbe4b-3440-452a-88a7-943531ac872a; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem virtualization ESXi Linux macOS Windows collection isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate subtechnique source_mapped

Detection and collection

T1074.001 detection workspace

Attack tools

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.