Cross-source coverage

T1074.001 / ATT&CK

Data Staged: Local Data Staging

20 rules · 19 families across 7 sources.

From MITRE ATT&CK 19.2

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.

Tactics
Collection
Platforms
ESXi · Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLmacos:unifiedlogesxi:vmkernelesxi:shell

How MITRE says to detect it DET0261

Detection of Local Data Staging Prior to Exfiltration

Windows Analytic 0724

Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior.

  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Security EventCode=4663, 4670, 4656

Linux Analytic 0725

Detects aggregation of files from different directories into /tmp, /mnt, or user-specified directories with archiving tools like tar or gzip.

  • auditd:SYSCALL open
  • auditd:SYSCALL execve

macOS Analytic 0726

Detects staged data aggregated in /Users/Shared, /private/tmp with compression tools like ditto or zip, initiated via Terminal or AppleScript.

  • macos:unifiedlog file events
  • macos:unifiedlog exec logs

ESXi Analytic 0727

Detects local staging behavior via snapshot creation or files written into VMFS partitions by scripts or unauthorized shell access.

  • esxi:vmkernel snapshot create/write events
  • esxi:shell CLI usage logs

View on attack.mitre.org ↗

elastic/protections-artifacts

7 rules · 6 families
Detection Severity Format
Data Encrypted and Archived 2 variants Undefined Elastic TOML
Data Encrypted and Archived 2 variants Undefined Elastic TOML
Environment Variable Secret Collection Undefined Elastic TOML
Information Stealer Collection via Find Undefined Elastic TOML
Multi-Value Secret Searching via Find Undefined Elastic TOML
Multi-Value Secret Searching via Grep Undefined Elastic TOML
Suspicious Archive Creation via Ditto Undefined Elastic TOML

elastic/detection-rules

5 rules
Detection Severity Format
Sensitive File Access followed by Compression High Elastic TOML
Discovery Command Output Written to Suspicious File Medium Elastic TOML
Exchange Mailbox Export via PowerShell Medium Elastic TOML
Data Encrypted via OpenSSL Utility Low Elastic TOML
Potential OpenSSH Backdoor Logging Activity Low Elastic TOML

SigmaHQ/sigma

4 rules
Detection Severity Format
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet Medium Sigma
Zip A Folder With PowerShell For Staging In Temp - PowerShell Medium Sigma
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module Medium Sigma
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script Medium Sigma

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Possible command injection attempts against Azure Integration Runtimes Undefined KQL

Wazuh Core Ruleset

1 rule
Detection Severity Format
Powershell script created a compressed file from results of filesystem search Low Wazuh XML

socfortress/Wazuh-Rules

1 rule
Detection Severity Format
Suspicious script execution via curl or wget piped to shell (Possible T1059.004 or T1074.001) High Wazuh XML

splunk/security_content

1 rule
Detection Severity Format
Shai-Hulud 2 Exfiltration Artifact Files Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.