Cross-source coverage

T1074.002 / ATT&CK

Data Staged: Remote Data Staging

4 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may Create Cloud Instance and stage data in that instance.

By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.

Tactics: Collection
Platforms: ESXi · IaaS · Linux · macOS · Windows
Telemetry: WinEventLog:SysmonWinEventLog:Microsoft-Windows-SMBClient/SecurityWinEventLog:PowerShellauditd:SYSCALLNSM:Flowmacos:unifiedlogesxi:vmkernelesxi:vobesxi:shellAWS:CloudTrailAWS:VPCFlowLogsesxi:hostd

How MITRE says to detect it DET0071

Detection of Remote Data Staging Prior to Exfiltration

Windows Analytic 0194

Detects file transfers or mounting operations from remote hosts followed by write actions into a local staging directory, often using SMB or remote shell activity.

WinEventLog:Sysmon EventCode=11
WinEventLog:Microsoft-Windows-SMBClient/Security EventCode=31001
WinEventLog:PowerShell CommandLine=copy-item or robocopy from UNC path

Linux Analytic 0195

Detects inbound SCP, rsync, or NFS mounts from remote systems followed by aggregation of files into known staging paths like /mnt/staging or /var/tmp.

auditd:SYSCALL open
auditd:SYSCALL execve
NSM:Flow SSH logins or scp activity

macOS Analytic 0196

Detects rsync or scp inbound from other hosts that then aggregate content into /Users/Shared or /private/tmp, often involving compressed files or scripts.

macos:unifiedlog exec logs
macos:unifiedlog file events
NSM:Flow remote login and transfer

ESXi Analytic 0197

Detects remote writes or snapshots mounted from other systems into a central ESXi VMFS path or NFS store used for remote staging of files before exfiltration.

esxi:vmkernel VMFS file creation
esxi:vob NFS/remote access logs
esxi:shell invoked remote scripts (esxcli)

IaaS Analytic 0198

Detects remote write activity across cloud VMs or object storage buckets within the same region/account that correlate with data aggregation across hosts.

AWS:CloudTrail GetObject, CopyObject
AWS:VPCFlowLogs Traffic between instances
esxi:hostd process execution across cloud VM

View on attack.mitre.org ↗

elastic/detection-rules

3 rules

Detection	Severity	Format
AWS RDS DB Instance Restored	Medium	Elastic TOML
Google Workspace Drive Data Transfer or Takeout Export Initiated	Medium	Elastic TOML
Remote File Copy to a Hidden Share	Medium	Elastic TOML

chronicle/detection-rules

1 rule

Detection	Severity	Format
google_workspace_ownership_transferred_on_google_drive	High	YARA-L