Which SIEM platforms have a T1074.002 detection rule?

df00tech provides T1074.002 (Remote Data Staging) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Remote Data Staging (T1074.002)?

Detecting Remote Data Staging requires the following data sources: File: File Creation, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

What severity and confidence is the T1074.002 detection?

The T1074.002 detection is rated high severity with medium confidence.

What are common false positives for T1074.002?

Common false positives for T1074.002 include: IT backup solutions (Veeam, Backup Exec, Windows Server Backup) legitimately copy large volumes of files to remote UNC shares on a scheduled basis; Software deployment tools (SCCM, Intune, PDQ Deploy) using robocopy or xcopy to distribute installers to staging directories across the environment; Developers or build systems copying compiled artifacts to shared network paths (CI/CD pipelines using MSBuild, Jenkins agents).

T1074.002 CrowdStrike LogScale · LogScale

Detect Remote Data Staging in CrowdStrike LogScale

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.

MITRE ATT&CK

Tactic: Collection
Technique: T1074 Data Staged
Sub-technique: T1074.002 Remote Data Staging
Canonical reference: https://attack.mitre.org/techniques/T1074/002/

LogScale Detection Query

CrowdStrike LogScale (LogScale)

cql

// Detection 1: Archive file creation in staging directories
#event_simpleName = "FileWritten"
| TargetFileName = /(?i)\.(zip|rar|7z|tar|gz|bz2|cab|iso|lzh|arj)$/
| TargetFileName = /(?i)\\(temp|tmp|public|programdata|appdata\\local\\temp|users\\public|inetpub\\wwwroot|wwwroot)\\/
| eval DetectionType = "ArchiveInStagingDir"
| table(_time, ComputerName, UserName, TargetFileName, ImageFileName, CommandLine, ParentBaseFileName, DetectionType)

// Detection 2: xcopy/robocopy to remote UNC paths
| union [
  #event_simpleName = "ProcessRollup2"
  | ImageFileName = /(?i)(xcopy\.exe|robocopy\.exe)$/
  | CommandLine = /\\\\\\/
  | eval DetectionType = "RemoteCopyToolToUNC"
  | table(_time, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, DetectionType)
]

// Detection 3: PowerShell/cmd staging via remote copy
| union [
  #event_simpleName = "ProcessRollup2"
  | ImageFileName = /(?i)(powershell\.exe|pwsh\.exe|cmd\.exe)$/
  | CommandLine = /(?i)(copy-item|move-item|xcopy|robocopy)/
  | CommandLine = /\\\\\\/
  | eval DetectionType = "PSCmdRemoteCopy"
  | table(_time, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, DetectionType)
]

// Aggregate and sort
| groupBy([ComputerName, UserName, DetectionType, ImageFileName, CommandLine, ParentBaseFileName], function=([count(as=EventCount), min(_time, as=FirstSeen), max(_time, as=LastSeen)]))
| sort(LastSeen, order=desc)

high severity high confidence

CrowdStrike LogScale (Falcon) query detecting Remote Data Staging across three sub-patterns: archive file creation in staging directories (FileWritten), remote copy tools targeting UNC paths (ProcessRollup2 for xcopy/robocopy), and PowerShell/cmd remote copy operations. Results are deduplicated with event count and time range.

Data Sources

CrowdStrike Falcon Endpoint DetectionFalcon Data Replicator (FDR)CrowdStrike LogScale (Humio)

Required Tables

#event_simpleName=FileWritten#event_simpleName=ProcessRollup2

False Positives & Tuning

Endpoint management solutions (SCCM, Intune, Tanium) that deploy software packages by staging compressed installers to %ProgramData% or %TEMP% then executing them
Robocopy-based folder redirection or profile migration tasks executed by domain GPO scripts during user logon to corporate workstations
Developers using PowerShell Copy-Item in build scripts to publish artifacts to shared development network drives (e.g., \\buildserver\drops\)

Download portable Sigma rule (.yml)

Other platforms for T1074.002

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Stage Files to Remote SMB Share via xcopy
Expected signal: Sysmon Event ID 1: Process Create for xcopy.exe with CommandLine containing UNC path '\\127.0.0.1\StagingTest$'. Sysmon Event ID 11: File Create events on the destination share. Security Event ID 5140 (if share auditing enabled): Network share 'StagingTest$' accessed. Security Event ID 4688 (if command line auditing enabled): xcopy.exe process creation with full command line.
Test 2Archive and Stage Collected Files in Public Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\Users\Public'. Sysmon Event ID 11: File Create event for the .zip file in C:\Users\Public\staging_test\. PowerShell ScriptBlock Logging Event ID 4104: Records the Compress-Archive command.
Test 3Stage Data in Web-Accessible Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\inetpub\wwwroot'. Sysmon Event ID 11: File Create event for the .zip file in C:\inetpub\wwwroot\uploads\. PowerShell ScriptBlock Logging Event ID 4104 with full command.
Test 4Remote Staging via PowerShell Copy-Item to UNC Path
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Copy-Item' and '\\127.0.0.1\RemoteStage$'. Sysmon Event ID 11: File Create events on the destination share path. Sysmon Event ID 3: Network connection from powershell.exe to 127.0.0.1 on port 445 (SMB). Security Event ID 5140 (if share auditing enabled): Network share access event.

Last updated: 2026-04-13 Research depth: deep

References (15)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1074.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Remote Data Staging in CrowdStrike LogScale

MITRE ATT&CK

LogScale Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1074.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Collection

Popular Detections

MITRE ATT&CK

LogScale Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1074.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Collection

Popular Detections

Get new detections in your inbox