The preparation step in which attackers gather, compress, and organise files before removing them from the environment. Staging is important because it often creates detectable behaviour, such as archive creation, bulk reads, and unusual transfer volume, before the final leak occurs.
What staging means in an exfiltration chain
Staging is the preparation phase before theft, not the theft itself. Attackers use it to gather scattered files, reduce the number of items they need to move, and make the payload easier to transfer through network, cloud, or removable-media channels. That consolidation step is operationally useful for the attacker and often creates a visible precursor to the final leak.
Because staging usually happens after collection but before egress, it sits at a useful point in the attack chain for defenders. The same activity that makes exfiltration efficient can also reveal intent: bulk reads, archive creation, temporary working directories, and repeated access to repositories or file shares are all signs that data is being assembled for removal.
Common staging behaviours defenders look for
Staging is usually not a single event. It often appears as a sequence of smaller actions, such as searching for target files, copying them into one location, compressing them, renaming them, or splitting them into chunks for later transfer. Attackers may use native tools or common archive utilities because they blend into ordinary administrative work.
The behaviours that matter most are those that change data shape or movement pattern. A sudden spike in archive creation, unusual reads of many files in a short period, or the appearance of a new staging directory can all indicate preparation for exfiltration. Those signals become stronger when they correlate with an unusual login, a new process tree, or access to repositories that are not normally used together.
Why staging is dangerous before the final transfer
Staging matters because it shortens the path between collection and loss. By packaging data first, attackers can move larger volumes more reliably, retry transfers more easily, and sometimes encrypt or obfuscate the contents before sending them out. That reduces the chance of interruption once the exfiltration phase begins.
It also raises the blast radius. A successful staging step can concentrate sensitive material into a single archive or working set, which means one subsequent transfer may expose data from many users, projects, or systems at once. The preparation phase therefore has both operational and security significance, especially in environments where archives, sync tools, or automated jobs are common.
How staging fits into detection and response
Defenders often treat staging as an early warning signal rather than a final verdict. Useful monitoring includes file activity, archive and compression telemetry, unusual access to repositories or shared drives, and egress patterns that do not match normal business use. When those signals are joined together, they can distinguish legitimate large transfers from pre-exfiltration behaviour.
Staging is also a practical place to scope impact if theft is suspected. If responders can identify the staging directory, archive set, or transfer queue, they can often infer which data was assembled, which host performed the packaging, and whether the data may already have been copied out. That makes staging evidence valuable both for containment and for post-incident review.
Risk and Threat Considerations
Staging creates a narrow but important window where defenders may still see the theft before the data leaves the environment. The main risk is that activity can look routine unless archive creation, mass reads, and transfer preparation are correlated across endpoint, identity, and network telemetry.
Failure mechanism: Attackers consolidate files into archives or transfer bundles, then move the staged set through a channel that is harder to inspect or block at the point of departure.
Impact: Sensitive data can leave in a smaller number of high-volume transfers, reducing reaction time and increasing the chance of broad confidentiality loss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1074 — Data Staged | Staging is the ATT&CK data staging technique used before exfiltration. |
| T1560 — Archive Collected Data | Compression and bundling are core archive-and-stage exfiltration behaviours. | |
| Recommendation — Map staging indicators to T1074 and alert on creation of transfer-ready file sets. Correlate archive creation and bulk file reads to T1560 activity in your detections. | ||
| NIST CSF 2.0 | DE.CM-09 — Network Monitoring | Staging often becomes visible through unusual transfer volume and egress patterns. |
| DE.CM-01 — Monitoring for Unauthorized Personnel, Connections, Devices, and Software | Unexpected staging usually appears alongside anomalous hosts, processes, or software use. | |
| Recommendation — Use DE.CM-09 monitoring to flag abnormal outbound data movement after collection. Apply DE.CM-01 to detect suspicious hosts or processes preparing data for export. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Staging investigation depends on endpoint, repository, and egress logs that show the prep chain. |
| Recommendation — Centralize and review logs that expose archive creation, bulk reads, and transfer preparation. | ||
Practitioner Guidance
What to watch for: Treat a sudden shift from ordinary file use to bulk reads, archive creation, and repeated access to the same repository or share as a staging pattern worth investigating. The most useful response is to confirm whether the activity matches a known job, user pattern, or approved transfer workflow before assuming it is malicious.
For defenders building deeper context, the Data Exfiltration Guide covers the broader exfiltration chain, while the T1560 and T1074 Archive and Stage Collected Data Defensive Guide explains the staging techniques and detection signals in more detail. The ATT&CK Collection Tactic Guide helps place staging in the wider collection phase so teams can separate normal access from pre-exfiltration activity.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org