value: Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](T1560). Interactive command shells may be used, and common functionality within [cmd](S0106) and bash may be used to copy data into a staging location.(Citation: PWC Cloud Hopper April 2017)
  
  In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](T1578.002) and stage data in that instance.(Citation: Mandiant M-Trends 2020)
  
  Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.
name: Data Staged