Skip to content
attack.paths
Connexion
← LibraryTechnique entry
T1074Collection

Data Staged

Stage data on a compromised host or intermediary before exfil — bundle, compress, encrypt for transport.

§ Where this technique fits

T1074 is catalogued under the Collection tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 6 on average.

Authoritative reference: attack.mitre.org/techniques/T1074/.

§ Dossiers chaining this technique

§ What commonly comes next

  1. 01
    Exfiltration Over C2 Channel
    T1041 · Exfiltration
    seen 1×