Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)
In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may Create Cloud Instance and stage data in that instance.(Citation: Mandiant M-Trends 2020)
Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1074 | Data Staged |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection of data staged attacks. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
Data staged attacks involve adversaries preparing stolen data or malicious payloads on a system, often in hidden or obfuscated locations, in anticipation of later exfiltration or execution. These attacks typically involve the collection, compression, or movement of data to make it easier to exfiltrate or deploy at a later stage, while avoiding detection by security tools. Intel TDT plays a crucial role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, enabling rapid detection of abnormal behaviors, such as suspicious file movements or data manipulation that could indicate data staging or preparation for exfiltration.
Additionally, CAMS offloads the memory scanning workload from the CPU to the Intel Integrated GPU, ensuring faster, more efficient detection of malicious activity without impacting system performance. CAMS helps identify suspicious behaviors, such as the unauthorized preparation or obfuscation of data for exfiltration, providing proactive defense against evasive data staging techniques.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1074.001 | Local Data Staging | 1 |