Procedure examples

During SharePoint ToolShell Exploitation, threat actors staged stolen data from web.config files to debug_dev.js.

During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration.

During Operation MidnightEclipse, threat actors copied files to the web application folder on compromised devices for exfiltration.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to stage extracted data and operational documentation in structured markdown files on local systems prior to exfiltration.

During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.

During Juicy Mix, OilRig used browser data and credential stealer tools to stage stolen files named Cupdate, Eupdate, and IUpdate in the %TEMP% directory.

During the C0032 campaign, TEMP.Veles used staging folders that are infrequently used by legitimate users or processes to store data for exfiltration and tool deployment.

During APT28 Nearest Neighbor Campaign, APT28 staged captured credential information in the C:\ProgramData directory.

During the 2025 Poland Wiper Attacks, the adversaries compiled discovery data locally on the victim host in a file located within `C:\Windows\TEMP\outlog.txt`.

APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.

During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.

Leviathan stored captured credential material on local log files on victim systems during Leviathan Australian Intrusions.

During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.