MITRE ATT&CK - Техника Промежуточное хранение данных (локально)

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Data Staged: Промежуточное хранение данных (локально)

Other sub-techniques of Data Staged (2)

ID	Название
.001	Промежуточное хранение данных (локально)
.002	Промежуточное хранение данных (удаленно)

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)

ID: T1074.001

Относится к технике: T1074

Тактика(-и): Collection

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, File: File Access, File: File Creation, Windows Registry: Windows Registry Key Modification

Версия: 1.1

Дата создания: 13 Mar 2020

Последнее изменение: 21 Apr 2022

Название	Описание
Примеры процедур
OopsIE	OopsIE stages the output from command execution and collected files in specific folders before exfiltration.(Citation: Unit 42 OopsIE! Feb 2018)
AuTo Stealer	AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.(Citation: MalwareBytes SideCopy Dec 2021)
Dtrack	Dtrack can save collected data to disk, different file formats, and network shares.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
Milan	Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.(Citation: ClearSky Siamesekitten August 2021)
NavRAT	NavRAT writes multiple outputs to a TMP file using the >> method.(Citation: Talos NavRAT May 2018)
Threat Group-3390	Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.(Citation: SecureWorks BRONZE UNION June 2017)
Sidewinder	Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.(Citation: ATT Sidewinder January 2021)
Ursnif	Ursnif has used tmp files to stage gathered information.(Citation: TrendMicro Ursnif Mar 2015)
FunnyDream	FunnyDream can stage collected information including screen captures and logged keystrokes locally.(Citation: Bitdefender FunnyDream Campaign November 2020)
Operation Wocao	Operation Wocao has staged archived files in a temporary directory prior to exfiltration.(Citation: FoxIT Wocao December 2019)
TEMP.Veles	TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.(Citation: FireEye TRITON 2019)
FIN5	FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.(Citation: Mandiant FIN5 GrrCON Oct 2016)
Dyre	Dyre has the ability to create files in a TEMP folder to act as a database to store information.(Citation: Malwarebytes Dyreza November 2015)
BadPatch	BadPatch stores collected data in log files before exfiltration.(Citation: Unit 42 BadPatch Oct 2017)
DarkWatchman	DarkWatchman can stage local data in the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
	During Operation Honeybee, stolen data was copied into a text file using the format `From (- --).txt` prior to compression, encoding, and exfiltration.(Citation: McAfee Honeybee)
	During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.(Citation: FoxIT Wocao December 2019)
Patchwork	Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.(Citation: TrendMicro Patchwork Dec 2017)
MacMa	MacMa has stored collected files locally before exfiltration.(Citation: Objective-See MacMa Nov 2021)
Carbon	Carbon creates a base directory that contains the files and folders that are collected.(Citation: ESET Carbon Mar 2017)
Ramsay	Ramsay can stage data prior to exfiltration in `%APPDATA%\Microsoft\UserSetting` and `%APPDATA%\Microsoft\UserSetting\MediaCache`.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
	During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.(Citation: DFIR Conti Bazar Nov 2021)
TeamTNT	TeamTNT has aggregated collected credentials in text files before exfiltrating.(Citation: Cisco Talos Intelligence Group)
InvisiMole	InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
Indrik Spider	Indrik Spider has stored collected date in a .tmp file.(Citation: Symantec WastedLocker June 2020)
SUGARDUMP	SUGARDUMP has stored collected data under `%%\\CrashLog.txt`.(Citation: Mandiant UNC3890 Aug 2022)
ADVSTORESHELL	ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.(Citation: ESET Sednit Part 2)
Lazarus Group	Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)
Chrommme	Chrommme can store captured system information locally prior to exfiltration.(Citation: ESET Gelsemium June 2021)
Duqu	Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.(Citation: Symantec W32.Duqu)
Attor	Attor has staged collected data in a central upload directory prior to exfiltration.(Citation: ESET Attor Oct 2019)
Chimera	Chimera has staged stolen data locally on compromised hosts.(Citation: NCC Group Chimera January 2021)
Honeybee	Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.(Citation: McAfee Honeybee)
RainyDay	RainyDay can use a file exfiltration tool to copy files to `C:\ProgramData\Adobe\temp` prior to exfiltration.(Citation: Bitdefender Naikon April 2021)
Dragonfly 2.0	Dragonfly 2.0 created a directory named "out" in the user's %AppData% folder and copied files to it.(Citation: US-CERT TA18-074A)
MuddyWater	MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.(Citation: Talos MuddyWater Jan 2022)
Gold Dragon	Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.(Citation: McAfee Gold Dragon)
Machete	Machete stores files and logs in a folder on the local drive.(Citation: ESET Machete July 2019)(Citation: Cylance Machete Mar 2017)
Trojan.Karagany	Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)
PoisonIvy	PoisonIvy stages collected data in a text file.(Citation: Symantec Darkmoon Aug 2005)
DustySky	DustySky created folders in temp directories to host collected files before exfiltration.(Citation: Kaspersky MoleRATs April 2019)
LightNeuron	LightNeuron can store email data in files and directories specified in its configuration, such as `C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\`.(Citation: ESET LightNeuron May 2019)
PowerLess	PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.(Citation: Cybereason PowerLess February 2022)
APT3	APT3 has been known to stage files for exfiltration in a single location.(Citation: aptsim)
QakBot	QakBot has stored stolen emails and other data into new folders prior to exfiltration.(Citation: Kroll Qakbot June 2020)
FrameworkPOS	FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.(Citation: FireEye FIN6 April 2016)
ccf32	ccf32 can temporarily store files in a hidden directory on the local host.(Citation: Bitdefender FunnyDream Campaign November 2020)
Octopus	Octopus has stored collected information in the Application Data directory on a compromised host.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
PUNCHBUGGY	PUNCHBUGGY has saved information to a random temp file before exfil.(Citation: Morphisec ShellTea June 2019)
MoonWind	MoonWind saves information from its keylogging routine as a .zip file in the present working directory.(Citation: Palo Alto MoonWind March 2017)
Helminth	Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.(Citation: Palo Alto OilRig May 2016)
Rover	Rover copies files from removable drives to `C:\system`.(Citation: Palo Alto Rover)
SPACESHIP	SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.(Citation: FireEye APT30)
Elise	Elise creates a file in `AppData\Local\Microsoft\Windows\Explorer` and stores all harvested data in that file.(Citation: Accenture Dragonfish Jan 2018)
SombRAT	SombRAT can store harvested data in a custom database under the %TEMP% directory.(Citation: BlackBerry CostaRicto November 2020)
Machete	Machete created their own directories to drop files into.(Citation: Cylance Machete Mar 2017)
Kimsuky	Kimsuky has staged collected data files under `C:\Program Files\Common Files\System\Ole DB\`.(Citation: CISA AA20-301A Kimsuky)(Citation: Talos Kimsuky Nov 2021)
APT39	APT39 has utilized tools to aggregate data prior to exfiltration.(Citation: FBI FLASH APT39 September 2020)
GALLIUM	GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.(Citation: Cybereason Soft Cell June 2019)
MESSAGETAP	MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.(Citation: FireEye MESSAGETAP October 2019)
Catchamas	Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.(Citation: Symantec Catchamas April 2018)
RawPOS	Data captured by RawPOS is placed in a temporary file under a directory named "memdump".(Citation: Kroll RawPOS Jan 2017)
Turian	Turian can store copied files in a specific directory prior to exfiltration.(Citation: ESET BackdoorDiplomacy Jun 2021)
Leviathan	Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.(Citation: FireEye Periscope March 2018)(Citation: CISA AA21-200A APT40 July 2021)
ObliqueRAT	ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.(Citation: Talos Oblique RAT March 2021)
menuPass	menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.(Citation: PWC Cloud Hopper April 2017)
BackdoorDiplomacy	BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.(Citation: ESET BackdoorDiplomacy Jun 2021)
Zebrocy	Zebrocy stores all collected information in a single file before exfiltration.(Citation: ESET Zebrocy Nov 2018)
NOKKI	NOKKI can collect data from the victim and stage it in `LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp`.(Citation: Unit 42 NOKKI Sept 2018)
MarkiRAT	MarkiRAT can store collected data locally in a created .nfo file.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Mustang Panda	Mustang Panda has stored collected credential files in `c:\windows\temp` prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Avira Mustang Panda January 2020)
Pteranodon	Pteranodon creates various subdirectories under `%Temp%\reports\%` and copies files to those subdirectories. It also creates a folder at `C:\Users\\AppData\Roaming\Microsoft\store` to store screenshot JPEG files.(Citation: Palo Alto Gamaredon Feb 2017)
Exaramel for Windows	Exaramel for Windows specifies a path to store files scheduled for exfiltration.(Citation: ESET TeleBots Oct 2018)
AppleSeed	AppleSeed can stage files in a central location prior to exfiltration.(Citation: Malwarebytes Kimsuky June 2021)
BADNEWS	BADNEWS copies documents under 15MB found on the victim system to is the user's `%temp%\SMB\` folder. It also copies files from USB devices to a predefined directory.(Citation: Forcepoint Monsoon)(Citation: TrendMicro Patchwork Dec 2017)
Calisto	Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.(Citation: Securelist Calisto July 2018)(Citation: Symantec Calisto July 2018)
KGH_SPY	KGH_SPY can save collected system information to a file named "info" before exfiltration.(Citation: Cybereason Kimsuky November 2020)
Crutch	Crutch has staged stolen files in the `C:\AMD\Temp` directory.(Citation: ESET Crutch December 2020)
Prikormka	Prikormka creates a directory, `%USERPROFILE%\AppData\Local\SKC\`, which is used to store collected log files.(Citation: ESET Operation Groundbait)
Kazuar	Kazuar stages command output and collected data in files before exfiltration.(Citation: Unit 42 Kazuar May 2017)
Mis-Type	Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.(Citation: Cylance Dust Storm)
Dragonfly	Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.(Citation: US-CERT TA18-074A)
BoxCaon	BoxCaon has created a working folder for collected files that it sends to the C2 server.(Citation: Checkpoint IndigoZebra July 2021)
NETWIRE	NETWIRE has the ability to write collected data to a file created in the `./LOGS` directory.(Citation: FireEye NETWIRE March 2019)
FLASHFLOOD	FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.(Citation: FireEye APT30)
APT28	APT28 has stored captured credential information in a file named pi.log.(Citation: Microsoft SIR Vol 19)
Astaroth	Astaroth collects data in a plaintext file named r1.log before exfiltration. (Citation: Cofense Astaroth Sept 2018)
STARWHALE	STARWHALE has stored collected data in a file called `stari.txt`.(Citation: Mandiant UNC3313 Feb 2022)
PUNCHTRACK	PUNCHTRACK aggregates collected data in a tmp file.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
ECCENTRICBANDWAGON	ECCENTRICBANDWAGON has stored keystrokes and screenshots within the `%temp%\GoogleChrome`, `%temp%\Downloads`, and `%temp%\TrendMicroUpdate` directories.(Citation: CISA EB Aug 2020)
USBStealer	USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.(Citation: ESET Sednit USBStealer 2014)(Citation: Kaspersky Sofacy)

Обнаружение

Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib. Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging. Monitor processes and command-line arguments for actions that could be taken to collect and combine files. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as Windows Management Instrumentation and PowerShell. Consider monitoring accesses and modifications to local storage repositories (such as the Windows Registry), especially from suspicious processes that could be related to malicious data collection.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.