has retrieved internal documents from machines inside victim environments including by using  to stage documents before exfiltration.(Citation: berwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm 2019)
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: has retrieved internal documents from machines inside victim environments including by using  to stage documents before exfiltration.(Citation: berwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)(Citation: TrendMicro Pawn Storm 2019) ### Response: T1005.