Why does an operator index and stage documents on the victim's own hosts before exfiltrating?

## The gap between access and objective An operator who has taken over an account with broad read rights, or an insider who already has them, is in the same position: they can read an enormous amount and know almost none of it. A mid-sized document estate holds millions of files under folder names invented by dozens of teams over a decade. Nothing about read access tells you which five documents describe the pricing model, the acquisition, or the design under negotiation. Closing that gap is the real work, and it happens *inside* the estate because that is where it is cheap. ## Enumerate, then index The first move is enumeration: list what exists. Directory listings, repository indexes, site and drive inventories - the platform hands these out to anyone entitled to read, because that is what a document system is for. The second move is the one that surprises people: the operator uses the estate's **own search service**. A document platform provides full-text search across everything an identity may read, and it is fast, complete and entirely ordinary to use. Content search does in a few queries what would otherwise take weeks of reading, and it produces exactly what the operator wants - a candidate list, ranked, with paths. ## Stage in one place The hits are then copied into a single staging location: one folder on a host that already holds documents, or one container in storage the estate already uses. Two reasons: 1. **It makes the transfer one event instead of thousands.** Pulling a thousand files individually from a thousand paths is slow, fragile and interruptible; a single archive is not. 2. **It puts the copy somewhere it does not look strange.** Documents accumulating on a file server are unremarkable; the same accumulation on an infrastructure host is not. ## Archive, and size the volumes to the carrier The staged set is archived - which compresses it, collapses it into one object, and incidentally makes the content opaque to anything that reads bytes in flight. Then it is frequently **split**: into volumes sized to what the chosen destination accepts in one request, or to whatever size is ordinary for that path. ATT&CK names this decision on its own (`T1030`, Data Transfer Size Limits) precisely because it is a deliberate choice about the carrier and not an accident of the archiving software. ## The point: exfiltration is the last and smallest step ``` Collection T1213 Data from Information Repositories -> the tenant's own search returns the candidate list Collection T1074.001 Local Data Staging -> hits copied into one folder on a document host Collection T1560.001 Archive Collected Data: via Utility -> archived, split into volumes the carrier accepts Exfiltration T1567.002 Exfiltration to Cloud Storage -> one upload to a permitted destination ... ``` Three of those four steps happen before a byte leaves. That is what makes the common mental picture - a huge outbound transfer as the whole of the attack - so misleading. By the time anything moves, the interesting decisions have already been made, and what moves is small because the staging step made it small. ## What raises the operator's cost here Since the expensive work is search, the controls that bite are the ones that make search expensive: narrowing what one identity may read (a smaller corpus means a smaller candidate list and more identities to obtain), and constraining estate-wide content search so a single account cannot enumerate everything it nominally may read. Neither of those is a control on the outbound path, which is the usual instinct. ## Common mistakes Saying 'they just copy everything' describes one objective - the extortion-scale sweep - and misses the espionage case entirely. Saying 'the archive is encrypted so nothing can be done' confuses making content opaque with making the operator's job cheap; the archive is a convenience, not the defence. And treating staging as an implementation detail hides the fact that it is where the operator spends most of their time on target.