Home/ MITRE Matrix/ Collection/ T1074.001

T1074.001Local Data Staging

T1074.001 — Local Data Staging is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 7 detection use cases covering it and 8 threat-intel articles citing it.

Collection

View on the matrix → Filter Detection Library MITRE official spec ↗

7Use cases

8Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1074 · Data Staged

Use cases covering this technique (7)

Shai-Hulud 2 Exfiltration Artifact Files ESCU actions · alerting P [LLM] Command line referencing Chrome Sync Data LevelDB passkey path (copy/stage for exfil) Bespoke actions · alerting DSΣPDDCS [LLM] anthropickit loot file '/tmp/runner_exfil.json' written to disk Bespoke actions · alerting DSΣPCS [LLM] node.js process staging credential dump in nt-* temp directory Bespoke actions · hunting DSΣPDDCS [LLM] SlimAgent keylogger HTML log artefact written to disk (Xagent-lineage colour scheme) Bespoke actions · hunting DSPDDCS [LLM] MuddyWater CE-Notes / LP-Notes / Blub stealer staging-file writes Bespoke actions · alerting DSΣPDDCS [LLM] Nx s1ngularity inventory file written to /tmp (inventory.txt / inventory.txt.bak) Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (8)

crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147

crit Anthropic's Fever Dream: Claude's package that stole real keys art-156

crit Webworm: New burrowing techniques art-459

crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-477

crit Sednit reloaded: Back in the trenches art-629

crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758

med MuddyWater: Snakes by the riverbank art-786

high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-888