Cross-source coverage

T1074 / ATT&CK

Data Staged

36 rules · 34 families across 10 sources.

From MITRE ATT&CK 19.2

Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may Create Cloud Instance and stage data in that instance.

Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.

Tactics
Collection
Platforms
ESXi · IaaS · Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogAWS:CloudTrailgcp:auditesxi:vmkernelesxi:shell

How MITRE says to detect it DET0014

Detection of Data Staging Prior to Exfiltration

Windows Analytic 0040

Detects staging of sensitive files into temporary or public directories, compression with 7zip/WinRAR, or batch copy prior to exfiltration.

  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1

Linux Analytic 0041

Detects script or user activity copying files to a central temp or /mnt directory followed by archive/compression utilities.

  • auditd:SYSCALL creat
  • auditd:SYSCALL execve

macOS Analytic 0042

Detects files collected into user temp or shared directories followed by compression with ditto, zip, or custom scripts.

  • macos:unifiedlog file events
  • macos:unifiedlog exec logs

IaaS Analytic 0043

Detects virtual disk expansion or file copy operations to cloud buckets or mounted volumes from isolated instances.

  • AWS:CloudTrail GetObject, CopyObject
  • gcp:audit Write operations to storage

ESXi Analytic 0044

Detects snapshots or data stored in VMFS volumes from root CLI or remote agents.

  • esxi:vmkernel VMFS access logs
  • esxi:shell snapshot create/copy, esxcli

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 36 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

9 rules
Detection Severity Format
Sensitive File Access followed by Compression High Elastic TOML
AWS EC2 Full Network Packet Capture Detected Medium Elastic TOML
AWS RDS DB Instance Restored Medium Elastic TOML
Discovery Command Output Written to Suspicious File Medium Elastic TOML
Exchange Mailbox Export via PowerShell Medium Elastic TOML
Google Workspace Drive Data Transfer or Takeout Export Initiated Medium Elastic TOML
Remote File Copy to a Hidden Share Medium Elastic TOML
Data Encrypted via OpenSSL Utility Low Elastic TOML
Potential OpenSSH Backdoor Logging Activity Low Elastic TOML

elastic/protections-artifacts

7 rules · 6 families
Detection Severity Format
Data Encrypted and Archived 2 variants Undefined Elastic TOML
Data Encrypted and Archived 2 variants Undefined Elastic TOML
Environment Variable Secret Collection Undefined Elastic TOML
Information Stealer Collection via Find Undefined Elastic TOML
Multi-Value Secret Searching via Find Undefined Elastic TOML
Multi-Value Secret Searching via Grep Undefined Elastic TOML
Suspicious Archive Creation via Ditto Undefined Elastic TOML

SigmaHQ/sigma

6 rules
Detection Severity Format
Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet Medium Sigma
Google Full Network Traffic Packet Capture Medium Sigma
Zip A Folder With PowerShell For Staging In Temp - PowerShell Medium Sigma
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module Medium Sigma
Zip A Folder With PowerShell For Staging In Temp - PowerShell Script Medium Sigma
Cisco Stage Data Low Sigma

socfortress/Wazuh-Rules

4 rules · 3 families
Detection Severity Format
Suspicious script execution via curl or wget piped to shell (Possible T1059.004 or T1074.001) High Wazuh XML
Sysmon - Event 1: Process creation · win.eventdata.ruleName = T1074.001 - PowerShell Compress-Archive ZIP Staging High Wazuh XML
Sysmon - Event 1: Process creation · Data Staged (T1074) 2 variants Low Wazuh XML
Sysmon - Event 1: Process creation · Data Staged (T1074) 2 variants Low Wazuh XML

Azure/Azure-Sentinel

3 rules
Detection Severity Format
Integrate Purview with Cloud App Events Medium KQL
Possible command injection attempts against Azure Integration Runtimes Undefined KQL
Suspicious enumeration using Adfind tool (Normalized Process Events) Undefined KQL

chainguard-dev/osquery-defense-kit

2 rules
Detection Severity Format
Catch applications running from unusual directories, such as /tmp Undefined osquery SQL
Catch applications running from unusual directories, such as /tmp (event-based) Undefined osquery SQL

splunk/security_content

2 rules
Detection Severity Format
Shai-Hulud 2 Exfiltration Artifact Files Undefined SPL
Suspicious SQLite3 LSQuarantine Behavior Undefined SPL

Wazuh Core Ruleset

1 rule
Detection Severity Format
Powershell script created a compressed file from results of filesystem search Low Wazuh XML

chronicle/detection-rules

1 rule
Detection Severity Format
google_workspace_ownership_transferred_on_google_drive High YARA-L

panther-labs/panther-analysis

1 rule
Detection Severity Format
Databricks Mount Point Creation Informational Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.