Detect Remote Data Staging in Google Chronicle

rule t1074_002_remote_data_staging {
  meta:
    author = "Detection Engineering"
    description = "Detects Remote Data Staging (T1074.002) - archive file creation in staging directories and remote copy tool usage to UNC paths"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1074.002"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1074/002/"
    created = "2026-04-13"
    version = "1.0"

  events:
    // Event variable for file creation in staging directory
    $file_event.metadata.event_type = "FILE_CREATION"
    $file_event.principal.hostname = $hostname
    (
      re.regex($file_event.target.file.full_path, `(?i)\\(temp|tmp|public|programdata|appdata\\local\\temp|users\\public|inetpub\\wwwroot|wwwroot)\\`)
    )
    re.regex($file_event.target.file.full_path, `(?i)\.(zip|rar|7z|tar|gz|bz2|cab|iso|lzh|arj)$`)

    // Event variable for process execution using copy/archive tools
    $proc_event.metadata.event_type = "PROCESS_LAUNCH"
    $proc_event.principal.hostname = $hostname
    (
      // Remote copy tools to UNC paths
      (
        re.regex($proc_event.target.process.file.full_path, `(?i)(xcopy\.exe|robocopy\.exe)$`) and
        re.regex($proc_event.target.process.command_line, `\\\\[a-zA-Z0-9]`)
      ) or
      // PowerShell/cmd remote copy
      (
        re.regex($proc_event.target.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe|cmd\.exe)$`) and
        re.regex($proc_event.target.process.command_line, `(?i)(copy-item|move-item|xcopy|robocopy)`) and
        re.regex($proc_event.target.process.command_line, `\\\\[a-zA-Z0-9]`)
      ) or
      // Compression tools creating archives
      re.regex($proc_event.target.process.file.full_path, `(?i)(7z\.exe|7za\.exe|rar\.exe|winrar\.exe|compact\.exe|tar\.exe)$`)
    )

  match:
    $hostname over 5m

  condition:
    $file_event and $proc_event
}