Data Staged
Adversaries may stage collected data in a central location or directory prior to exfiltration. Data may be kept in separate files or combined into one file through archiving techniques. Adversaries choose staging to minimize the number of connections made to their C2 server and better evade detection. Staging locations are commonly temp directories, user profile folders, or hidden directories. In cloud environments, adversaries may stage data within a particular instance before exfiltration.
What is T1074 Data Staged?
Data Staged (T1074) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.
This page provides production-ready detection logic for Data Staged, covering the data sources and telemetry it touches: File: File Creation, File: File Modification, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1074 Data Staged
- Canonical reference
- https://attack.mitre.org/techniques/T1074/
let StagingPaths = dynamic([
"\\Temp\\", "\\tmp\\", "\\AppData\\Local\\Temp\\",
"\\AppData\\Roaming\\", "\\ProgramData\\",
"\\Users\\Public\\", "\\Windows\\Temp\\"
]);
let StagingExtensions = dynamic([".zip", ".7z", ".rar", ".tar", ".gz", ".cab", ".iso"]);
let BulkCopyProcesses = dynamic(["robocopy.exe", "xcopy.exe", "copy", "cp", "rsync"]);
// Branch 1: Bulk file creation events in staging paths
let BulkFileStaging =
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (StagingPaths)
| summarize FileCount=count(), Extensions=make_set(tolower(tostring(split(FileName, ".")[-1]))), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| where FileCount >= 10
| extend StagingType="BulkFileStaging"
| project Timestamp=LastSeen, DeviceName, AccountName=InitiatingProcessAccountName,
InitiatingProcessFileName, InitiatingProcessCommandLine,
FolderPath, FileCount, Extensions, StagingType;
// Branch 2: Archive files created in staging paths
let ArchiveStaging =
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has_any (StagingPaths)
| where FileName has_any (StagingExtensions)
| extend StagingType="ArchiveCreated"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
InitiatingProcessFileName, InitiatingProcessCommandLine,
FolderPath, FileName, StagingType;
// Branch 3: Bulk copy commands executed
let BulkCopyStaging =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("robocopy.exe", "xcopy.exe", "cmd.exe", "powershell.exe")
| where ProcessCommandLine has_any ("robocopy", "xcopy", "copy /", "Copy-Item", "cp -r")
and ProcessCommandLine has_any (StagingPaths)
| extend StagingType="BulkCopyCommand"
| project Timestamp, DeviceName, AccountName, FileName,
ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
StagingType;
union BulkFileStaging, ArchiveStaging, BulkCopyStaging
| sort by Timestamp descDetects data staging behaviors using Microsoft Defender for Endpoint tables. Three detection branches: (1) bulk file creation events in common staging paths where 10+ files are written by the same process, indicating automated data aggregation; (2) archive files created in staging directories, suggesting compression before exfiltration; (3) bulk copy commands (robocopy, xcopy, Copy-Item) targeting staging directories. Uses DeviceFileEvents for file-level telemetry and DeviceProcessEvents for command-line analysis.
Data Sources
Required Tables
False Positives
- Software installation processes that extract files to temp directories during setup (installers, MSI packages)
- Backup agents (Veeam, Backup Exec, Windows Backup) that stage files before writing to backup media
- Software deployment tools (SCCM, Intune) copying update packages to staging directories
- Log aggregation tools that collect and consolidate logs into a single directory for shipping
- Developers using robocopy/xcopy in legitimate build scripts or deployment pipelines
Sigma rule & cross-platform mapping
The detection logic for Data Staged (T1074) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1074
References (8)
- https://attack.mitre.org/techniques/T1074/
- https://attack.mitre.org/techniques/T1074/001/
- https://attack.mitre.org/techniques/T1074/002/
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
- https://www.crowdstrike.com/blog/wizard-spider-adversary-update/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1074.001/T1074.001.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file
- https://web.archive.org/web/20220224041316/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stage Sensitive Files to Temp Directory Using Robocopy
Expected signal: Sysmon Event ID 1: Process Create with Image=robocopy.exe, CommandLine containing source and destination temp paths with /E /COPYALL flags. Sysmon Event ID 11: Multiple FileCreate events in %TEMP%\df00tech-stage\ for each copied file. Security Event ID 4688 (if command line auditing enabled) for robocopy.exe execution. DeviceProcessEvents and DeviceFileEvents will capture this in MDE environments.
- Test 2Stage and Compress Data Using 7-Zip from Command Line
Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with copy command, then 7z.exe with -p flag (password) targeting staging directory. Sysmon Event ID 11: FileCreate events for each copied file in df00tech-collection\, then FileCreate for df00tech-exfil.zip. The -p flag in 7z.exe command line indicates password protection — a high-fidelity indicator of malicious intent.
- Test 3Stage Data Using PowerShell Copy-Item to ProgramData
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with Copy-Item in CommandLine targeting C:\ProgramData\MicrosoftUpdates. Sysmon Event ID 11: Multiple FileCreate events in C:\ProgramData\MicrosoftUpdates\. Sysmon Event ID 12/13: Registry or attribute change if attrib command is monitored. The directory name 'MicrosoftUpdates' is a common masquerading technique — look for this in DeviceFileEvents FolderPath.
- Test 4Linux Data Staging Using cp and tar
Expected signal: Linux auditd syscall events (if configured): open/creat syscalls for files in /tmp/.df00tech_stage/, execve for cp, find, tar commands. Syslog entries if auditd rules cover /tmp/ writes. If Sysmon for Linux is deployed: Sysmon Event ID 11 for file creations, Event ID 1 for process creation with tar czf command. The hidden directory name (.df00tech_stage with leading dot) indicates deliberate concealment.
- Test 5Remote Data Staging via Network Share Copy
Expected signal: Sysmon Event ID 1: Process Create for net.exe (net use) with UNC path and xcopy.exe with /E /H /Y flags. Sysmon Event ID 3: Network Connection to target host on port 445 (SMB). Sysmon Event ID 11: FileCreate events in staging directory. Security Event ID 4648 (explicit credential logon) if credentials were provided to net use. Security Event ID 5140/5145 (network share access) on the target host if SMB auditing is enabled.
Unlock Pro Content
Get the full detection package for T1074 including response playbook, investigation guide, and atomic red team tests.