T1074

Data Staged

Collection Last updated:

Adversaries may stage collected data in a central location or directory prior to exfiltration. Data may be kept in separate files or combined into one file through archiving techniques. Adversaries choose staging to minimize the number of connections made to their C2 server and better evade detection. Staging locations are commonly temp directories, user profile folders, or hidden directories. In cloud environments, adversaries may stage data within a particular instance before exfiltration.

What is T1074 Data Staged?

Data Staged (T1074) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Data Staged, covering the data sources and telemetry it touches: File: File Creation, File: File Modification, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Collection
Technique
T1074 Data Staged
Canonical reference
https://attack.mitre.org/techniques/T1074/
Microsoft Sentinel / Defender
kusto 
let StagingPaths = dynamic([
  "\\Temp\\", "\\tmp\\", "\\AppData\\Local\\Temp\\",
  "\\AppData\\Roaming\\", "\\ProgramData\\",
  "\\Users\\Public\\", "\\Windows\\Temp\\"
]);
let StagingExtensions = dynamic([".zip", ".7z", ".rar", ".tar", ".gz", ".cab", ".iso"]);
let BulkCopyProcesses = dynamic(["robocopy.exe", "xcopy.exe", "copy", "cp", "rsync"]);
// Branch 1: Bulk file creation events in staging paths
let BulkFileStaging =
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath has_any (StagingPaths)
| summarize FileCount=count(), Extensions=make_set(tolower(tostring(split(FileName, ".")[-1]))), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| where FileCount >= 10
| extend StagingType="BulkFileStaging"
| project Timestamp=LastSeen, DeviceName, AccountName=InitiatingProcessAccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FolderPath, FileCount, Extensions, StagingType;
// Branch 2: Archive files created in staging paths
let ArchiveStaging =
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has_any (StagingPaths)
| where FileName has_any (StagingExtensions)
| extend StagingType="ArchiveCreated"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FolderPath, FileName, StagingType;
// Branch 3: Bulk copy commands executed
let BulkCopyStaging =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("robocopy.exe", "xcopy.exe", "cmd.exe", "powershell.exe")
| where ProcessCommandLine has_any ("robocopy", "xcopy", "copy /", "Copy-Item", "cp -r")
    and ProcessCommandLine has_any (StagingPaths)
| extend StagingType="BulkCopyCommand"
| project Timestamp, DeviceName, AccountName, FileName,
    ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine,
    StagingType;
union BulkFileStaging, ArchiveStaging, BulkCopyStaging
| sort by Timestamp desc

Detects data staging behaviors using Microsoft Defender for Endpoint tables. Three detection branches: (1) bulk file creation events in common staging paths where 10+ files are written by the same process, indicating automated data aggregation; (2) archive files created in staging directories, suggesting compression before exfiltration; (3) bulk copy commands (robocopy, xcopy, Copy-Item) targeting staging directories. Uses DeviceFileEvents for file-level telemetry and DeviceProcessEvents for command-line analysis.

high severity medium confidence

Data Sources

File: File Creation File: File Modification Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceFileEvents DeviceProcessEvents

False Positives

  • Software installation processes that extract files to temp directories during setup (installers, MSI packages)
  • Backup agents (Veeam, Backup Exec, Windows Backup) that stage files before writing to backup media
  • Software deployment tools (SCCM, Intune) copying update packages to staging directories
  • Log aggregation tools that collect and consolidate logs into a single directory for shipping
  • Developers using robocopy/xcopy in legitimate build scripts or deployment pipelines

Sigma rule & cross-platform mapping

The detection logic for Data Staged (T1074) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1074 Sigma rules on detection.fyi

Platform-specific guides for T1074

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-18 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Stage Sensitive Files to Temp Directory Using Robocopy

    Expected signal: Sysmon Event ID 1: Process Create with Image=robocopy.exe, CommandLine containing source and destination temp paths with /E /COPYALL flags. Sysmon Event ID 11: Multiple FileCreate events in %TEMP%\df00tech-stage\ for each copied file. Security Event ID 4688 (if command line auditing enabled) for robocopy.exe execution. DeviceProcessEvents and DeviceFileEvents will capture this in MDE environments.

  2. Test 2Stage and Compress Data Using 7-Zip from Command Line

    Expected signal: Sysmon Event ID 1: Process Create for cmd.exe with copy command, then 7z.exe with -p flag (password) targeting staging directory. Sysmon Event ID 11: FileCreate events for each copied file in df00tech-collection\, then FileCreate for df00tech-exfil.zip. The -p flag in 7z.exe command line indicates password protection — a high-fidelity indicator of malicious intent.

  3. Test 3Stage Data Using PowerShell Copy-Item to ProgramData

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with Copy-Item in CommandLine targeting C:\ProgramData\MicrosoftUpdates. Sysmon Event ID 11: Multiple FileCreate events in C:\ProgramData\MicrosoftUpdates\. Sysmon Event ID 12/13: Registry or attribute change if attrib command is monitored. The directory name 'MicrosoftUpdates' is a common masquerading technique — look for this in DeviceFileEvents FolderPath.

  4. Test 4Linux Data Staging Using cp and tar

    Expected signal: Linux auditd syscall events (if configured): open/creat syscalls for files in /tmp/.df00tech_stage/, execve for cp, find, tar commands. Syslog entries if auditd rules cover /tmp/ writes. If Sysmon for Linux is deployed: Sysmon Event ID 11 for file creations, Event ID 1 for process creation with tar czf command. The hidden directory name (.df00tech_stage with leading dot) indicates deliberate concealment.

  5. Test 5Remote Data Staging via Network Share Copy

    Expected signal: Sysmon Event ID 1: Process Create for net.exe (net use) with UNC path and xcopy.exe with /E /H /Y flags. Sysmon Event ID 3: Network Connection to target host on port 445 (SMB). Sysmon Event ID 11: FileCreate events in staging directory. Security Event ID 4648 (explicit credential logon) if credentials were provided to net use. Security Event ID 5140/5145 (network share access) on the target host if SMB auditing is enabled.

Response Playbook

Triage

  1. Identify the staging directory — is it a well-known temp path (C:\Windows\Temp, %APPDATA%\Local\Temp) or an unusual custom directory (e.g., C:\ProgramData\<random>, C:\Users\Public\<random>)? Custom directories created specifically for staging are higher priority.
  2. Examine the initiating process — what spawned the file copy operations? Legitimate backup agents (veeam, beremote.exe) or deployment tools (ccmexec.exe, msiexec.exe) are low risk; cmd.exe, powershell.exe, or unusual binaries are high risk.
  3. Review the file types being staged — documents (.docx, .xlsx, .pdf), database files (.db, .sqlite, .mdb), source code (.py, .cs, .go), or credentials (.kdbx, .pfx, .pem, .key) indicate sensitive data collection. Archive files (.zip, .7z, .rar) suggest data has been aggregated and is ready for exfiltration.
  4. Check the timeline — does file staging correlate with prior collection events (screencaptures, keylogging, browser history access) or with network connections to external IPs shortly after? Use DeviceNetworkEvents to correlate.
  5. Assess the volume and velocity — staging 10 files over an hour is very different from staging 500 files in 2 minutes. Rapid bulk writes indicate automated tooling.
  6. Determine the user account context — is the staging happening under a service account, SYSTEM, or a regular user? Is it expected for this account to be copying this volume of files?
  7. Check if similar staging activity is occurring on multiple endpoints within the same time window — simultaneous staging across hosts indicates a worm, automated post-exploitation framework, or ransomware preparing to exfiltrate before encryption.

Containment

  1. If exfiltration appears imminent or active: immediately isolate the endpoint using EDR network isolation to prevent data from leaving the environment. Document the staging directory path before isolating.
  2. Preserve the staging directory contents — do NOT delete before forensic collection. Request IR team to image the staging directory and any archive files present.
  3. If a compromised user account is confirmed: disable the account in Active Directory, revoke all active sessions (Azure AD sign-out, Kerberos TGT invalidation), and rotate credentials for any accounts the user had access to.
  4. Block outbound connections from the affected host to all non-corporate destinations at the network layer (firewall rule, NAC policy) if full isolation is not feasible.
  5. If staging is happening via a malicious script or binary: block the process hash in your EDR platform and deploy a blocking rule across the fleet.
  6. Search for the same staging directory path or process across the entire environment to identify other potentially compromised hosts.

Evidence Collection

  1. Staging directory contents — copy all files from the staging directory with metadata preserved (creation/modification timestamps). Use robocopy /COPYALL or tar with --preserve-permissions on Linux to maintain forensic integrity.
  2. Archive files in staging directory — extract and catalog contents of any .zip, .7z, .rar, .tar.gz files found. Note the file types and sensitivity classification of staged data.
  3. Sysmon Event ID 11 (File Create) logs — identifies every file written to the staging directory, with timestamps, source process, and initiating user. Collect from Microsoft-Windows-Sysmon/Operational log.
  4. Sysmon Event ID 1 (Process Create) logs — captures the full command line of any copy/archive utility used for staging. Correlate with Event ID 11 timestamps.
  5. File system MFT (Master File Table) artifacts — MFT records contain precise creation, modification, and access timestamps for every file. Use tools like MFTECmd or Velociraptor to extract MFT for the staging volume.
  6. Prefetch files — C:\Windows\Prefetch\<PROCESS>.EXE-*.pf for any copy utilities used (ROBOCOPY.EXE, XCOPY.EXE, 7Z.EXE). Prefetch records execution timestamps and up to 128 referenced file paths.
  7. USN Journal ($UsnJrnl:\$J) — records file creation, deletion, and rename events on NTFS volumes. Provides a chronological record of all file activity in the staging directory.
  8. ShellBags — HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU — records directories the user navigated to, which may reveal manually accessed staging directories.
  9. Recent Items (RecentDocs) — HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs — may show recently accessed files from the staging location if opened by a human operator.
  10. Network flow logs — capture all outbound connections from the affected host in the 1 hour following staging activity. Focus on connections to external IPs on ports 443, 80, 22, or non-standard high ports.

Escalation Criteria

  • ! Staging directory contains credentials, certificates, or key material (.kdbx, .pfx, .pem, .key, SAM hive files, NTDS.DIT copies)
  • ! Staging activity is followed within minutes by outbound network connections to external IPs — indicates active exfiltration in progress
  • ! Staging occurring under SYSTEM or a privileged service account with no corresponding change management ticket
  • ! More than 3 endpoints showing simultaneous staging activity — indicates automated post-exploitation framework or worm-like propagation
  • ! Staging directory contains files sourced from multiple hosts (network shares, remote paths) — indicates data collection beyond the local machine
  • ! Archive files in staging directory are password-protected — adversary is preparing for exfiltration and anticipating detection (Volt Typhoon TTP)
  • ! Staging directory is within a location with network share access or synced to cloud storage (OneDrive, Dropbox, Google Drive folder paths)

Investigation Guide

Forensic Artifacts

  • > NTFS MFT entries — $STANDARD_INFORMATION and $FILE_NAME timestamps for every file in the staging directory. Look for $STANDARD_INFORMATION timestamps earlier than $FILE_NAME timestamps (timestomping indicator).
  • > USN Journal ($UsnJrnl:\$J) — records all file create, modify, rename, and delete operations chronologically. Can reconstruct the staging sequence even if files have been deleted.
  • > Prefetch files — C:\Windows\Prefetch\ROBOCOPY.EXE-*.pf, XCOPY.EXE-*.pf, 7Z.EXE-*.pf. Contain up to 128 file paths referenced during execution and last run timestamps.
  • > ShellBags (Registry) — HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU records directories browsed via Explorer. Staging directories may appear here if a human operator navigated to them.
  • > LNK files — %APPDATA%\Microsoft\Windows\Recent\ — link files created when a user opens a file. May point to files opened from the staging directory.
  • > RecentDocs Registry — HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\ — tracks recently accessed files by extension.
  • > Sysmon Event ID 11 logs — Microsoft-Windows-Sysmon/Operational — complete file creation history with process context. Critical for reconstructing staging timeline.
  • > Sysmon Event ID 23/26 (File Delete) — if adversary cleaned up staging directory after exfiltration, deletion events provide evidence of what existed.
  • > Windows Search Index — %PROGRAMDATA%\Microsoft\Search\Data\Applications\Windows\ — may have indexed files in the staging directory, preserving filenames even after deletion.
  • > Archive file metadata — 7-Zip/WinRAR archives contain internal timestamps and sometimes the host/user that created them. Use 7z l <archive> to extract metadata.
  • > Linux: /var/run/*.pid — Kobalos malware stages SSH credentials here. Check for unexpected .pid files containing non-PID content.
  • > Linux: bash_history, ~/.bash_history — cp, rsync, tar commands targeting staging directories will appear in history unless cleared.

Tuning Guidance

The primary challenge with data staging detection is distinguishing legitimate backup, deployment, and logging activity from malicious staging. Start by building a process allowlist: identify all backup agent processes (veeam_agent.exe, beremote.exe, backupd, wbengine.exe), deployment tools (ccmexec.exe, msiexec.exe, PackageAssetPublisher.exe), and log aggregators in your environment. Allowlist these by process name AND expected source/destination path combinations — never allowlist a process globally, only in the specific context where it is expected. Next, tune file count thresholds based on your environment. In a developer environment, 50 files/hour in temp directories may be normal; on a standard corporate endpoint, 10 files/hour is unusual. Consider adding a sensitive file extension filter (focusing on .docx, .xlsx, .pdf, .db, .kdbx, .pem) to the bulk file count branch to prioritize alerts involving sensitive data types. For the archive creation branch, reduce false positives by correlating with subsequent network activity — an archive created and then immediately transmitted externally is high confidence; an archive that sits in place for days is likely legitimate. Finally, implement a suppression list for known-good staging paths used by IT infrastructure (e.g., C:\Windows\ccmcache\, C:\Windows\SoftwareDistribution\Download\) and exclude these from alerting. Run hunting queries weekly rather than as real-time alerts to identify baseline patterns before tightening thresholds.

Hunting Queries

Hunt for high-velocity file creation bursts in staging directories — 20+ files written within a 1-hour window at a rate of 2+ files per minute by the same user/process. This pattern indicates automated data collection tooling rather than manual user activity. Adjust thresholds based on environment baseline. A legitimate backup writing 100 files/min is expected; a cmd.exe process doing so is not.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FolderPath matches regex @"(?i)\\(temp|tmp|appdata\\local\\temp|windows\\temp|programdata|users\\public)\\"
| summarize FileCount=count(),
    UniqueExtensions=dcount(tolower(tostring(split(FileName, ".")[-1]))),
    Extensions=make_set(tolower(tostring(split(FileName, ".")[-1]))),
    TotalSizeMB=sum(FileSize) / 1048576,
    FirstFile=min(Timestamp),
    LastFile=max(Timestamp)
    by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, bin(Timestamp, 1h)
| where FileCount >= 20
| extend DurationMin=datetime_diff('minute', LastFile, FirstFile)
| extend FilesPerMinute=iff(DurationMin > 0, FileCount / DurationMin, FileCount)
| where FilesPerMinute >= 2
| sort by FilesPerMinute desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  (TargetFilename="*\\Temp\\*" OR TargetFilename="*\\tmp\\*" OR TargetFilename="*\\Windows\\Temp\\*"
   OR TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\ProgramData\\*")
| bin _time span=1h
| stats count as FileCount,
    dc(TargetFilename) as UniqueFiles,
    values(Image) as Processes,
    earliest(_time) as FirstFile,
    latest(_time) as LastFile
    by _time, host, User
| where FileCount >= 20
| eval DurationMin=round((LastFile - FirstFile) / 60, 1)
| eval FilesPerMin=if(DurationMin > 0, round(FileCount / DurationMin, 1), FileCount)
| where FilesPerMin >= 2
| sort - FilesPerMin

Hunt for archive file creation by non-archiving processes in non-standard locations, correlated with subsequent outbound network connections to public IPs within 30 minutes. This chain — unexpected archive creation followed by external network activity — strongly suggests stage-then-exfiltrate behavior. Excludes user-initiated archiving from Downloads/Desktop and known archive manager GUIs.

Hunting — KQL
kql 
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileCreated"
| where FileName has_any (".zip", ".7z", ".rar", ".tar", ".gz", ".cab")
| where FolderPath !has "Downloads" and FolderPath !has "Desktop"
| where InitiatingProcessFileName !in~ ("msiexec.exe", "setup.exe", "install.exe", "7zFM.exe",
    "winzip.exe", "peazip.exe", "bandizip.exe", "WinRAR.exe")
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine,
    FolderPath, FileName, FileSize
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteIPType == "Public"
    | summarize NetConnections=count(), RemoteIPs=make_set(RemoteIP), RemotePorts=make_set(RemotePort)
        by DeviceName, bin(Timestamp, 30m)
) on DeviceName
| where isnotempty(RemoteIPs)
| sort by Timestamp desc

Hunt for robocopy and xcopy commands targeting staging directories, grouped by destination path and initiating process. Multiple executions to the same staging destination across different hosts suggests a centralized staging operation — possibly a lateral movement-then-stage pattern seen in groups like Wizard Spider and INC Ransom. Robocopy and xcopy are preferred by threat actors for bulk staging because they preserve timestamps and are built into Windows.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("robocopy.exe", "xcopy.exe")
| where ProcessCommandLine has_any ("\\Temp\\", "\\tmp\\", "\\Public\\", "\\ProgramData\\")
| extend DestinationPath = extract(@"(?:robocopy|xcopy)\s+\S+\s+(\S+)", 1, ProcessCommandLine)
| summarize Count=count(), CommandLines=make_set(ProcessCommandLine), Devices=dcount(DeviceName)
    by AccountName, InitiatingProcessFileName, DestinationPath, bin(Timestamp, 1d)
| where Count >= 2 or Devices >= 2
| sort by Devices desc, Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\robocopy.exe" OR Image="*\\xcopy.exe")
  (CommandLine="*\\Temp\\*" OR CommandLine="*\\tmp\\*" OR CommandLine="*\\Public\\*" OR CommandLine="*\\ProgramData\\*")
| rex field=CommandLine "(?:robocopy|xcopy)\s+\S+\s+(?P<DestPath>\S+)"
| stats count as ExecCount,
    dc(host) as AffectedHosts,
    values(CommandLine) as CommandLines,
    values(User) as Users
    by ParentImage, DestPath
| where ExecCount >= 2 OR AffectedHosts >= 2
| sort - AffectedHosts ExecCount

Atomic Red Team Tests

Test 1 Stage Sensitive Files to Temp Directory Using Robocopy
windows

Simulates an adversary using robocopy to bulk-copy files into a staging directory prior to exfiltration. Robocopy is a Windows built-in tool commonly abused for staging because it supports recursive copy, mirror mode, and timestamp preservation. This test creates sample files representing sensitive data types and stages them to a temp directory.

Command

powershell 
mkdir %TEMP%\df00tech-stage 2>nul && mkdir %TEMP%\df00tech-source 2>nul && echo SSN: 123-45-6789 > %TEMP%\df00tech-source\credentials.txt && echo Internal VPN config > %TEMP%\df00tech-source\vpn.conf && echo DB password: P@ssw0rd123 > %TEMP%\df00tech-source\database.txt && robocopy %TEMP%\df00tech-source %TEMP%\df00tech-stage /E /COPYALL

Cleanup

powershell 
rmdir /S /Q %TEMP%\df00tech-stage 2>nul & rmdir /S /Q %TEMP%\df00tech-source 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=robocopy.exe, CommandLine containing source and destination temp paths with /E /COPYALL flags. Sysmon Event ID 11: Multiple FileCreate events in %TEMP%\df00tech-stage\ for each copied file. Security Event ID 4688 (if command line auditing enabled) for robocopy.exe execution. DeviceProcessEvents and DeviceFileEvents will capture this in MDE environments.

Expected Detection

Alert fires on bulk file creation in staging path by robocopy.exe. KQL BulkCopyStaging branch: ProcessCommandLine contains 'robocopy' AND staging path. SPL: EventCode=1, Image=robocopy.exe, CommandLine matches staging path patterns. File creation events trigger BulkFileStaging branch when FileCount >= 3 for this small test (adjust threshold).

Test 2 Stage and Compress Data Using 7-Zip from Command Line
windows

Simulates the common adversary pattern of collecting data, staging it to a temp directory, then compressing it into a password-protected archive. This two-phase pattern (stage then archive) is used by Volt Typhoon and INC Ransom groups. The password protection is a strong indicator of deliberate preparation for exfiltration.

Command

powershell 
mkdir %TEMP%\df00tech-collection 2>nul && copy %USERPROFILE%\Documents\*.* %TEMP%\df00tech-collection\ 2>nul & copy %USERPROFILE%\Desktop\*.txt %TEMP%\df00tech-collection\ 2>nul & "C:\Program Files\7-Zip\7z.exe" a -tzip -p"Sup3rS3cr3t" %TEMP%\df00tech-exfil.zip %TEMP%\df00tech-collection\*

Cleanup

powershell 
rmdir /S /Q %TEMP%\df00tech-collection 2>nul & del /F /Q %TEMP%\df00tech-exfil.zip 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for cmd.exe with copy command, then 7z.exe with -p flag (password) targeting staging directory. Sysmon Event ID 11: FileCreate events for each copied file in df00tech-collection\, then FileCreate for df00tech-exfil.zip. The -p flag in 7z.exe command line indicates password protection — a high-fidelity indicator of malicious intent.

Expected Detection

KQL ArchiveStaging branch: FileName matches .zip extension, FolderPath contains \Temp\. SPL: EventCode=11, TargetFilename matches zip extension in staging path AND EventCode=1 for 7z.exe with -p flag. The combination of bulk file copy followed by password-protected archive creation is high confidence.

Test 3 Stage Data Using PowerShell Copy-Item to ProgramData
windows

Simulates an adversary using PowerShell's Copy-Item cmdlet to stage files in C:\ProgramData\, a location commonly used because it is writable by all users and not typically monitored. The use of a hidden directory attribute and recursion mirrors techniques observed in post-exploitation frameworks.

Command

powershell 
powershell.exe -Command "New-Item -ItemType Directory -Path 'C:\ProgramData\MicrosoftUpdates' -Force | Out-Null; attrib +h 'C:\ProgramData\MicrosoftUpdates'; Copy-Item -Path '$env:USERPROFILE\Documents\*' -Destination 'C:\ProgramData\MicrosoftUpdates\' -Recurse -Force -ErrorAction SilentlyContinue; Get-ChildItem 'C:\ProgramData\MicrosoftUpdates' | Measure-Object | Select-Object -ExpandProperty Count"

Cleanup

powershell 
powershell.exe -Command "attrib -h 'C:\ProgramData\MicrosoftUpdates'; Remove-Item -Path 'C:\ProgramData\MicrosoftUpdates' -Recurse -Force -ErrorAction SilentlyContinue"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with Copy-Item in CommandLine targeting C:\ProgramData\MicrosoftUpdates. Sysmon Event ID 11: Multiple FileCreate events in C:\ProgramData\MicrosoftUpdates\. Sysmon Event ID 12/13: Registry or attribute change if attrib command is monitored. The directory name 'MicrosoftUpdates' is a common masquerading technique — look for this in DeviceFileEvents FolderPath.

Expected Detection

KQL BulkCopyCommand branch: ProcessCommandLine contains 'Copy-Item' AND 'ProgramData'. KQL BulkFileStaging branch: FolderPath contains \ProgramData\ with FileCount >= 10. SPL: EventCode=1 with Copy-Item and ProgramData in CommandLine. The hidden attribute combined with ProgramData staging is a high-confidence indicator.

Test 4 Linux Data Staging Using cp and tar
linux

Simulates adversary staging on Linux systems by copying sensitive files to /tmp/ and /var/run/ (used by Kobalos malware for credential staging), then creating a compressed tarball. These paths are writable by all users and often overlooked in file monitoring.

Command

bash 
mkdir -p /tmp/.df00tech_stage && cp /etc/passwd /tmp/.df00tech_stage/passwd.bak && cp /etc/hosts /tmp/.df00tech_stage/hosts.bak && find /home -name '*.ssh' -type d 2>/dev/null | xargs -I{} cp -r {} /tmp/.df00tech_stage/ 2>/dev/null; tar czf /tmp/.df00tech_archive.tar.gz /tmp/.df00tech_stage/ 2>/dev/null && ls -la /tmp/.df00tech_archive.tar.gz

Cleanup

bash 
rm -rf /tmp/.df00tech_stage /tmp/.df00tech_archive.tar.gz

Expected Telemetry

Linux auditd syscall events (if configured): open/creat syscalls for files in /tmp/.df00tech_stage/, execve for cp, find, tar commands. Syslog entries if auditd rules cover /tmp/ writes. If Sysmon for Linux is deployed: Sysmon Event ID 11 for file creations, Event ID 1 for process creation with tar czf command. The hidden directory name (.df00tech_stage with leading dot) indicates deliberate concealment.

Expected Detection

Linux auditd rules targeting /tmp/ and /var/run/ writes with abnormal file extensions (.bak, .tar.gz). Process creation events for tar with czf flags targeting /tmp/. If Sysmon for Linux is deployed, SPL query EventCode=11 with TargetFilename matching /tmp/.*\.tar\.gz pattern. The combination of cp /etc/passwd followed by tar compression is a high-confidence indicator.

Test 5 Remote Data Staging via Network Share Copy
windows

Simulates T1074.002 (Remote Data Staging) by mapping a network share and copying files from the local system to a remote staging location. Adversaries use this to centralize data from multiple endpoints to a single collection point before exfiltration, minimizing the number of external connections needed.

Command

powershell 
net use Z: \\127.0.0.1\C$ /user:%USERNAME% 2>nul || echo Share mapping skipped - use valid share path in real test & mkdir %TEMP%\df00tech-remote-stage 2>nul && xcopy /E /I /H /Y %USERPROFILE%\Documents %TEMP%\df00tech-remote-stage\%COMPUTERNAME%_docs\ 2>nul

Cleanup

powershell 
net use Z: /delete /yes 2>nul & rmdir /S /Q %TEMP%\df00tech-remote-stage 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create for net.exe (net use) with UNC path and xcopy.exe with /E /H /Y flags. Sysmon Event ID 3: Network Connection to target host on port 445 (SMB). Sysmon Event ID 11: FileCreate events in staging directory. Security Event ID 4648 (explicit credential logon) if credentials were provided to net use. Security Event ID 5140/5145 (network share access) on the target host if SMB auditing is enabled.

Expected Detection

KQL BulkCopyCommand branch: ProcessCommandLine contains 'xcopy' with /E flag and staging path. DeviceNetworkEvents showing SMB (port 445) connections correlated with subsequent file staging. SPL: EventCode=1 for xcopy, EventCode=3 for port 445 connections within same time window, EventCode=11 for bulk file creates.

Related Detections

Tactic Hub

TA0009Collection

Sub-techniques (2)

Related Techniques

T1074.001Local Data StagingT1074.002Remote Data StagingT1560.001Archive via UtilityT1560.002Archive via LibraryT1041Exfiltration Over C2 ChannelT1048Exfiltration Over Alternative ProtocolT1005Data from Local SystemT1039Data from Network Shared DriveT1025Data from Removable MediaT1083File and Directory DiscoveryT1119Automated Collection

Same Tactic: Collection

Popular Detections