Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/T1074/T1074.001
MITRE ATT&CK Sub-Technique

T1074.001: Local Data Staging

ShareXLinkedInRedditHN

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)

Tactics
Collection
Platforms
ESXi, Linux, macOS, Windows

▪Parent technique

T1074: Data Staged

▪Used by groups (28)

G0007APT28G0022APT3G0027Threat Group-3390G0030Lotus BlossomG0032Lazarus GroupG0035DragonflyG0040PatchworkG0045menuPassG0053FIN5G0065LeviathanG0069MuddyWaterG0087APT39G0090WIRTEG0093GALLIUMG0094KimsukyG0102Wizard SpiderG0114ChimeraG0119Indrik SpiderG0121SidewinderG0129Mustang PandaG0135BackdoorDiplomacyG0139TeamTNTG1016FIN13G1017Volt TyphoonG1023APT5G1030AgriusG1046Storm-1811G1048UNC3886

▪Software using this technique (94)

S0012PoisonIvymalwareS0013PlugXmalwareS0024DyremalwareS0035SPACESHIPmalwareS0036FLASHFLOODmalwareS0038DuqumalwareS0045ADVSTORESHELLmalwareS0062DustySkymalwareS0081ElisemalwareS0084Mis-TypemalwareS0090RovermalwareS0094Trojan.KaraganymalwareS0113PrikormkamalwareS0128BADNEWSmalwareS0136USBStealermalwareS0147PteranodonmalwareS0149MoonWindmalwareS0169RawPOSmalwareS0170HelminthmalwareS0196PUNCHBUGGYmalwareS0197PUNCHTRACKmalwareS0198NETWIREmalwareS0247NavRATmalwareS0249Gold DragonmalwareS0251ZebrocymalwareS0260InvisiMolemalwareS0261CatchamasmalwareS0264OopsIEmalwareS0265KazuarmalwareS0274CalistomalwareS0335CarbonmalwareS0337BadPatchmalwareS0340OctopusmalwareS0343Exaramel for WindowsmalwareS0353NOKKImalwareS0373AstarothmalwareS0386UrsnifmalwareS0395LightNeuronmalwareS0409MachetemalwareS0438AttormalwareS0443MESSAGETAPmalwareS0458RamsaymalwareS0503FrameworkPOSmalwareS0526KGH_SPYmalwareS0538CrutchmalwareS0567DtrackmalwareS0593ECCENTRICBANDWAGONmalwareS0615SombRATmalwareS0622AppleSeedmalwareS0629RainyDaymalwareS0644ObliqueRATmalwareS0647TurianmalwareS0650QakBotmalwareS0651BoxCaonmalwareS0652MarkiRATmalwareS0667ChrommmemalwareS0673DarkWatchmanmalwareS1012PowerLessmalwareS1015MilanmalwareS1016MacMamalwareS1029AuTo StealermalwareS1037STARWHALEmalwareS1042SUGARDUMPmalwareS1043ccf32malwareS1044FunnyDreammalwareS1059metaMainmalwareS1060MafaldamalwareS1075KOPILUWAKmalwareS1090NightClubmalwareS1101LoFiSemalwareS1104SLOWPULSEmalwareS1109PACEMAKERmalwareS1110SLIGHTPULSEmalwareS1124SocGholishmalwareS1142LunarMailmalwareS1149CHIMNEYSWEEPmalwareS1153Cuckoo StealermalwareS1154VersaMemmalwareS1168SampleCheck5000malwareS1172OilBoostermalwareS1196Troll StealermalwareS1210SagerunexmalwareS1213Lumma StealermalwareS1222RIFLESPINEmalwareS1233PAKLOGmalwareS1235CorKLOGmalwareS1245InvisibleFerretmalwareS1246BeaverTailmalwareS9010GlassWormmalwareS9013DRYHOOKmalwareS9020LODEINFOmalwareS9022MirrorStealermalwareS9035LAMEHUGmalwareS9036LP-Notesmalware

▪Reference

T1074.001on MITRE ATT&CK

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.