Detect Remote Data Staging in Elastic Security
Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1074 Data Staged
- Sub-technique
- T1074.002 Remote Data Staging
- Canonical reference
- https://attack.mitre.org/techniques/T1074/002/
Elastic Detection Query
sequence by host.name with maxspan=5m
[file where event.action == "creation" and
file.extension in ("zip", "rar", "7z", "tar", "gz", "bz2", "cab", "iso", "lzh", "arj") and
(
file.path like~ "*\\Temp\\*" or
file.path like~ "*\\tmp\\*" or
file.path like~ "*\\Public\\*" or
file.path like~ "*\\ProgramData\\*" or
file.path like~ "*\\Windows\\Temp\\*" or
file.path like~ "*\\AppData\\Local\\Temp\\*" or
file.path like~ "*\\inetpub\\wwwroot\\*" or
file.path like~ "*\\Users\\Public\\*"
)
] by user.name
[process where event.action == "start" and
process.name in~ ("xcopy.exe", "robocopy.exe", "7z.exe", "7za.exe", "rar.exe", "winrar.exe", "compact.exe", "tar.exe") or
(process.name in~ ("powershell.exe", "pwsh.exe", "cmd.exe") and
process.args like~ "*\\\\*" and
(process.args like~ "*Copy-Item*" or process.args like~ "*xcopy*" or process.args like~ "*robocopy*" or process.args like~ "*Move-Item*"))
] by user.name
OR
process where event.action == "start" and
process.name in~ ("xcopy.exe", "robocopy.exe") and
process.args like~ "*\\\\*"Detects Remote Data Staging (T1074.002) by correlating archive file creation in common staging directories with use of copy/compression tools targeting remote UNC paths. Uses EQL sequence to link file creation and process execution within the same session.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT backup tools (e.g., Veeam, Acronis agents) that compress data and copy to network shares as part of scheduled backup jobs
- Software deployment pipelines that stage build artifacts (zip/tar) to shared network directories for deployment to servers
- Help desk or IT staff using robocopy/xcopy to migrate user profile data or files during workstation refresh operations
Other platforms for T1074.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stage Files to Remote SMB Share via xcopy
Expected signal: Sysmon Event ID 1: Process Create for xcopy.exe with CommandLine containing UNC path '\\127.0.0.1\StagingTest$'. Sysmon Event ID 11: File Create events on the destination share. Security Event ID 5140 (if share auditing enabled): Network share 'StagingTest$' accessed. Security Event ID 4688 (if command line auditing enabled): xcopy.exe process creation with full command line.
- Test 2Archive and Stage Collected Files in Public Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\Users\Public'. Sysmon Event ID 11: File Create event for the .zip file in C:\Users\Public\staging_test\. PowerShell ScriptBlock Logging Event ID 4104: Records the Compress-Archive command.
- Test 3Stage Data in Web-Accessible Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\inetpub\wwwroot'. Sysmon Event ID 11: File Create event for the .zip file in C:\inetpub\wwwroot\uploads\. PowerShell ScriptBlock Logging Event ID 4104 with full command.
- Test 4Remote Staging via PowerShell Copy-Item to UNC Path
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Copy-Item' and '\\127.0.0.1\RemoteStage$'. Sysmon Event ID 11: File Create events on the destination share path. Sysmon Event ID 3: Network connection from powershell.exe to 127.0.0.1 on port 445 (SMB). Security Event ID 5140 (if share auditing enabled): Network share access event.
References (15)
- https://attack.mitre.org/techniques/T1074/002/
- https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf
- https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
- https://www.secureworks.com/research/bronze-union
- https://www.fireeye.com/content/dam/fireeye-www/summit/ciso-summit-2016/cs16-know-your-enemy-fin8.pdf
- https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-fin6.pdf
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
- https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/
- https://securelist.com/toddycat-check-logs/110696/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/xcopy
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1074.002/T1074.002.md
Unlock Pro Content
Get the full detection package for T1074.002 including response playbook, investigation guide, and atomic red team tests.