Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)

In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)

Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.
Data Staged
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1074  external_id: T1074     source_name: Mandiant M-Trends 2020  description: Mandiant. (2020, February). M-Trends 2020. Retrieved April 24, 2020.  url: https://content.fireeye.com/m-trends/rpt-m-trends-2020     source_name: PWC Cloud Hopper April 2017  description: PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.  url: https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf     