Local Data Staging
Parent: T1074
Description
Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
Mapped SPARTA techniques
No techniques mapped to this control.
Cross-framework references
Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.
Countered by 14 in MITRE D3FEND (Defensive Techniques)
- D3-CFContent Filtering
- D3-CMContent Modification
- D3-CQContent Quarantine
- D3-DFDecoy File
- D3-FAFile Analysis
- D3-FCAFile Creation Analysis
- D3-FEFile Encryption
- D3-FEVFile Eviction
- D3-FIMFile Integrity Monitoring
- D3-LFPLocal File Permissions
- D3-RFRestore File
- D3-RFAMRemote File Access Mediation
- D3-SCASystem Call Analysis
- D3-SCFSystem Call Filtering
Cite as SafeMode Space, mitre-attack-enterprise T1074.001.