Forensia CTI Core

About

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.

Platforms: ESXi, Linux, macOS, WindowsParent: T1074 Data StagedMITRE ATT&CK ↗

Software

94 malware/tools implement this

PoisonIvyPlugXDyreSPACESHIPFLASHFLOODDuquADVSTORESHELLDustySkyEliseMis-TypeRoverTrojan.KaraganyPrikormkaBADNEWSUSBStealerPteranodonMoonWindRawPOSHelminthPUNCHBUGGYPUNCHTRACKNETWIRENavRATGold DragonZebrocyInvisiMoleCatchamasOopsIEKazuarCalistoCarbonBadPatchOctopusExaramel for WindowsNOKKIAstarothUrsnifLightNeuronMacheteAttorMESSAGETAPRamsayFrameworkPOSKGH_SPYCrutchDtrackECCENTRICBANDWAGONSombRATAppleSeedRainyDayObliqueRATTurianQakBotBoxCaonMarkiRATChrommmeDarkWatchmanPowerLessMilanMacMaAuTo StealerSTARWHALESUGARDUMPccf32FunnyDreammetaMainMafaldaKOPILUWAKNightClubLoFiSeSLOWPULSEPACEMAKERSLIGHTPULSESocGholishLunarMailCHIMNEYSWEEPCuckoo StealerVersaMemSampleCheck5000OilBoosterTroll StealerSagerunexLumma StealerRIFLESPINEPAKLOGCorKLOGInvisibleFerretBeaverTailGlassWormDRYHOOKLODEINFOMirrorStealerLAMEHUGLP-Notes

Corpus indicators tagged with this technique

131 indicators in the corpus carry T1074.001.

Indicator	Type	Family	Sev	Src
cve-2025-68670	cve	—	85	2
0c514e137860f489e3801213460ef938	hash	—	80	1
0857c84b62289a1a9f29e19244e9a499	hash	—	80	2
51eed154b4cd5e949a709a26da673d925cabe1be	hash	—	80	1
78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981	hash	supply_chain	80	1
097ca205ad9e3b72018750280904718c	hash	—	80	1
f8cbe44fde6914bc8d06426c03c92ed536c891470292e567a586b54af29c2442	hash	—	80	2
c0d1eaa15a2cefbab9735787575c8d8e	hash	—	80	1
67d7e3aeeb673bf60c59361c12a4ed81	hash	—	80	1
d5b38b252cf212a4a32763de36732d40	hash	—	80	1
369b75bdcded16469ede7ab8bedcfae1	hash	—	80	1
6544aa44dfdd5e6c4985155af83a6b8884a23e2d4c9b71a66ee1fe8ebf66a2b4	hash	—	80	1
0577db70844e88b32b954906e2f20798	hash	—	80	2
0320dd389fdbab25d46792bd2817675e	hash	—	80	2
c5702eb250f855c8c872fffb9bb656ed	hash	—	80	1
1b39e86eb772a0e40060b672b7f574f1	hash	—	80	1
216cb7f31d383c0dd892b284df05a495	hash	—	80	1
25c8ed0511375dca57ef136ac3fa0cca	hash	—	80	1
28ecf8fb6719e14231b94b4d37629b0e	hash	—	80	1
2aa1e9765ef6b00b94a9b6be0041436a	hash	—	80	1
2cabb721681455dae1b6a26709def453	hash	—	80	1
36120f5e9411bcbac7104ef3fa964ed2	hash	—	80	1
116f59e70a9df97f4adaea71eecb1e9a	hash	—	80	1
493b901d1b33eb577db64aadd948f9ce	hash	—	80	1
51f7f794ed43fb90d0f8ebbb5effe628	hash	—	80	1
5329f7bff9d0d5db28821b86c26d628f	hash	—	80	1
7242ac065b50bcde9308756b49dbadcb	hash	—	80	1
7a95360b7e0eb5b107a3d231abbc541a	hash	—	80	1
7f776ad200287d6de14a29158c457179	hash	—	80	1
131877a052f62750d815cf55d4c14f606a26025e3094e1b8bb18bd1668e3beaa	hash	ransomware	80	1

Showing the top 30 by severity of 131.