Home/ MITRE Matrix/ Collection/ T1074.001

T1074.001Local Data Staging

T1074.001 — Local Data Staging is a MITRE ATT&CK technique in the Collection tactic. Clankerusecase tracks 8 detection use cases covering it and 9 threat-intel articles citing it.

Collection

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

9Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1074 · Data Staged

Use cases covering this technique (8)

Shai-Hulud 2 Exfiltration Artifact Files ESCU actions · alerting P [LLM] ZIP archive named with public-IPv4 pattern created in user-writable directory (Gremlin Stealer) Bespoke actions · hunting DSΣPDDCS [LLM] node.js process staging credential dump in nt-* temp directory Bespoke actions · hunting DSΣPDDCS [LLM] SlimAgent keylogger HTML log artefact written to disk (Xagent-lineage colour scheme) Bespoke actions · hunting DSPDDCS [LLM] s1ngularity collection artifact — `/tmp/inventory.txt` written by node/npm on runner Bespoke actions · alerting DSΣPDDCS [LLM] MuddyWater CE-Notes / LP-Notes / Blub stealer staging-file writes Bespoke actions · alerting DSΣPDDCS [LLM] s1ngularity nx: /tmp/inventory.txt staging file created on host Bespoke actions · alerting DSΣPDD [LLM] Nx s1ngularity inventory file written to /tmp (inventory.txt / inventory.txt.bak) Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (9)

crit Webworm: New burrowing techniques art-240

high Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files art-281

crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-284

crit Sednit reloaded: Back in the trenches art-477

high 10,000 Open-Source Projects Now Secured by Harden-Runner Community-Tier: A Milestone Three Years in the Making art-536

crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-642

med MuddyWater: Snakes by the riverbank art-676

crit s1ngularity: Popular Nx Build System Package Compromised with Data-Stealing Malware art-778

high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-806