Data Staged
Description
Adversaries may stage collected data in a central location before exfiltration. Staging consolidates, organizes, or prepares information obtained from one or more sources so it can be reviewed, processed, transferred, or retrieved more efficiently.
Data may be staged on a compromised local system, another system in the victim environment, a cloud instance, shared storage, an application repository, or other remote infrastructure. It may remain in separate files or be combined into archives, databases, structured documents, manifests, or other collections. Adversaries may compress, encrypt, encode, split, rename, or otherwise transform staged data.
- ATLAS ID
- AML.T0127
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Enterprise
Mitigations
ATLAS 2026.09 lists no mitigation for this technique.
Case studies that use it
Related ATT&CK technique
ATLAS adapts this technique from MITRE ATT&CK Enterprise.
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-FCAFile Creation Analysis1 shared
- D3-DNRDecoy Network Resource1 shared
- D3-NRAMNetwork Resource Access Mediation1 shared
- D3-SCASystem Call Analysis1 shared
- D3-SCFSystem Call Filtering1 shared
- D3-CFContent Filtering1 shared
- D3-CMContent Modification1 shared
- D3-DFDecoy File1 shared
- D3-FAFile Analysis1 shared
- D3-FEFile Encryption1 shared
- D3-FEVFile Eviction1 shared
- D3-FIMFile Integrity Monitoring1 shared