T1074.001 Local Data Staging

Technique

T1074.001

Tactics

Collection

Research, 90 days

3

KEV CVEs mapped

0

SigmaHQ rules

4

Elastic, Splunk

8

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1074/001

MITRE description

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-30 Darktrace: CikaBika Bot: Inside a Discord RAT Campaign
• 2026-10-19 Rapid7: Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
• 2026-08-27 Recorded Future Insikt: BlueDelta Targets Defense and Diplomacy with HOOKEDGE

Detection coverage

SigmaHQ community rules

• Zip A Folder With PowerShell For Staging In Temp - PowerShell (core)
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Module (core)
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Script (core)
• Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet (core)

Elastic and Splunk rules

• Data Encrypted via OpenSSL Utility (elastic)
• Potential OpenSSH Backdoor Logging Activity (elastic)
• Discovery Command Output Written to Suspicious File (elastic)
• Sensitive File Access followed by Compression (elastic)
• Exchange Mailbox Export via PowerShell (elastic)
• File Compressed or Archived into Common Format by Unsigned Process (elastic)
• File Staged in Root Folder of Recycle Bin (elastic)
• Shai-Hulud 2 Exfiltration Artifact Files (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.