T1074.001 — Local Data Staging

Tactic: Collection · Platforms: ESXi, Linux, macOS, Windows

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within…

Sub-technique of Data Staged (T1074).

Sigma detection rules (4)

title: "T1074.001 Data Staged: Local Data Staging"
id: cb72f075-c8fc-46d5-a619-024741b55946
description: 'Detection of Local Data Staging Prior to Exfiltration. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: StagingDirList, ArchivingToolPatterns, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1074/001
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.collection
  - attack.t1074.001

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'

  selection_archiver:
    Image|endswith:
      - '\rar.exe'
      - '\winrar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\tar.exe'
      - '\makecab.exe'

  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Windows\Temp\'
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.cab'
      - '.tar'
      - '.gz'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and (selection_archiver or selection_path) and not filter_system_account

falsepositives:
  - IT staff or scheduled jobs using WinRAR/7-Zip to compress files in temp/ProgramData directories for legitimate backup or support purposes; tune ArchivingToolPatterns/StagingDirList allowlists.

level: medium

title: "T1074.001 Data Staged: Local Data Staging"
id: bd02509d-076d-42a5-91a7-46ac7c1389af
description: 'Detection of Local Data Staging Prior to Exfiltration. The prior staging-path check assumed the temp directory was literally argv position a1, but tar/gzip/zip invocations commonly place flags or multiple paths before/after it; the path is now matched across a1 through a3. A companion correlation rule (below) counts repeated archive-creation events within a short window to separate bulk-staging bursts from routine single-file backups, since no aggregation threshold was previously implemented despite the tuning note naming one. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: StagingDirs, ArchiveUtilities, UserThreshold.'
references:
  - https://attack.mitre.org/techniques/T1074/001
author: Shahrukh Khan
date: 2026-05-22
license: MIT
tags:
  - attack.collection
  - attack.t1074.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/tar'
      - '/gzip'
      - '/zip'
  selection_staging_path:
    - a1|contains:
        - '/tmp/'
        - '/var/tmp/'
        - '/dev/shm/'
    - a2|contains:
        - '/tmp/'
        - '/var/tmp/'
        - '/dev/shm/'
    - a3|contains:
        - '/tmp/'
        - '/var/tmp/'
        - '/dev/shm/'

  condition: selection and selection_staging_path

falsepositives:
  - Legitimate admins and cron jobs stage archives in /tmp for backup/transfer purposes; requires correlation with which source paths were archived, and the paired correlation rule below to distinguish bulk staging from a single routine backup.

level: medium
---
title: "T1074.001 Data Staged: Local Data Staging - Repeated Archive Creation Burst"
id: 5c8e2a3d-7b1f-4e6a-9c0d-3f5b8a1e6d92
description: 'Correlation companion for bd02509d-076d-42a5-91a7-46ac7c1389af: counts archive-creation events into temp/staging directories within a 10-minute window, approximating bulk data-staging behavior rather than a single routine backup.'
status: experimental
correlation:
  type: event_count
  rules:
    - bd02509d-076d-42a5-91a7-46ac7c1389af
  timespan: 10m
  condition:
    gte: 5
level: high

title: "T1074.001 Data Staged: Local Data Staging"
id: 8273f9b8-1361-4fb3-bd54-a26017f4ffc8
description: 'Detection of Local Data Staging Prior to Exfiltration. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: StagingTargets, CompressionBinaries, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1074/001
author: Shahrukh Khan
date: 2026-02-24
license: MIT
tags:
  - attack.collection
  - attack.t1074.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/zip'
      - '/tar'
      - '/ditto'
    CommandLine|contains:
      - '/tmp/'
      - '/private/tmp/'
      - '/Application Support/'

  condition: selection

falsepositives:
  - Developers packaging build artifacts into temp directories generate the same archive commands.

level: medium

title: "T1074.001 Data Staged: Local Data Staging"
id: 1c2560fb-1525-49ca-aad2-5d068b07e3d2
description: 'Detection of Local Data Staging Prior to Exfiltration. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SnapshotThreshold, CLIInvoker, VMFSWriteRate.'
references:
  - https://attack.mitre.org/techniques/T1074/001
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.collection
  - attack.t1074.001

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains:
      - 'vim-cmd vmsvc/snapshot.create'
      - 'tar -cvf'
  selection_path:
    CommandLine|contains: '/vmfs/volumes/'

  condition: selection and selection_path

falsepositives:
  - Scheduled backup jobs invoked through the same CLI commands for legitimate VM protection will also match.

level: medium

Related sub-techniques

• T1074.002 Remote Data Staging

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1074.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan