Threadlinqs IntelligenceStart free

ATT&CK techniqueCollection

T1074 Data Staged

CollectionEnterprise

As of 2026-10-05, T1074 (Data Staged) appears in 120 tracked threats, first reported 2021-11-25 and most recently 2026-08-04, with linked actors including Scattered Spider, ShinyHunters, TeamPCP; it most often appears alongside T1059 (Command and Scripting Interpreter).

Tracked threats
12047 critical, 66 high, 6 medium
First seen
2021-11-25
Last seen
2026-08-04
Threat actors
61In the threats using it
Detection rules
34Blue tier and above

Data as of:

Activity timeline

T1074 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 47 reports, and 119 of the 120 threats were reported in the twelve months to 2026-08.

How adversaries use it

T1074 Data Staged is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix. Threadlinqs maps 120 of 2623 tracked threats (4.6%) to it; by severity that is 47 critical, 66 high, 6 medium.

Threats that use T1074 most often also use T1059 Command and Scripting Interpreter (93 threats), T1041 Exfiltration Over C2 Channel (83 threats), T1071 Application Layer Protocol (83 threats), T1082 System Information Discovery (79 threats), T1005 Data from Local System (74 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

61 tracked threat actors appear in the threats that use T1074; the most frequent are Scattered Spider (5), ShinyHunters (5), TeamPCP (5), UNC6240 (5), MuddyWater (4).

Data sources

Telemetry that can reveal T1074, per MITRE ATT&CK.

  • Command — Command Execution
  • File — File Access, File Creation
  • Windows Registry — Windows Registry Key Modification

Threat actors using it

Tracked threats

The 30 most recent of 120 tracked threats that use T1074.

Detection coverage

Threadlinqs maintains 34 detection rules mapped to T1074 (SPL 6, KQL 11, Sigma 17). Rule content is available to Blue tier accounts and above; this page shows counts only.

34 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Sub-techniques