T1074.001

Official Description

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.

Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)

Tactics: Collection
Platforms: ESXi, Linux, macOS, Windows
Parent Technique: T1074 · Data Staged
MITRE Version: 1.2
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (1)

DragonDoll stored collected notifications, SMS messages and operational results in a local SQLite database. DragonDoll Android Spyware Disguised as a Google Chrome Update

Malware (1)

MITRE ATT&CK (8)

Products (7)

Tools (2)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.