Data Staged
Technique · ATTACK:enterprise:T1074
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1074",
"title": "Data Staged",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1074",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--7dd95ff6-712e-4056-9626-312ea4ab4c5e",
"external_id": "T1074",
"domain": "enterprise",
"created": "2017-05-31T21:30:58.938Z",
"modified": "2026-05-12T15:12:00.645Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Mandiant M-Trends 2020",
"url": "https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf"
},
{
"source_name": "PWC Cloud Hopper April 2017",
"url": "https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e781fb0-6abb-4473-9a55-4028f1ec7d1a
AI-Mexico-Govt-BreachATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c54816e-5dd1-4723-99f5-29c80a2fc171
CrowdStrike Grim Spider May 2019ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f9e7f23-979c-4d7f-a19c-907dc94504aa
Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--348b0aa4-9f9a-46f3-81fa-96f5156c03c9
FBI IC3 Flash VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:T1074.001 → subtechnique-of → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4180422b-a478-4ceb-ac8c-6fe86c85399c
ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--514198d4-dac9-4982-8d80-429b7843b639
SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023ATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--773e62aa-8b0a-4ed2-9954-1886c789e926
ESET Kobalos Jan 2021ATTACK:enterprise:S1020 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a87a63cc-7920-4b23-a804-d1ad94ffc120
Kaspersky Lyceum October 2021ATTACK:enterprise:S1076 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2e0fa0b-ccc4-4bd9-a981-2aa198491333
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc10559e-6a98-4a5f-abcd-adff67bfb1cd
CISA Scattered Spider Advisory November 2023ATTACK:enterprise:T1074.002 → subtechnique-of → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e128847e-b3ae-420a-b46f-cb9db88f2cf4
ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1074
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3b14839-81b5-436f-87b0-f5b8bd10c07c
ClearSky Siamesekitten August 2021