Detect Remote Data Staging in Microsoft Sentinel
Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1074 Data Staged
- Sub-technique
- T1074.002 Remote Data Staging
- Canonical reference
- https://attack.mitre.org/techniques/T1074/002/
KQL Detection Query
let StagingPaths = dynamic([
"\\Temp\\", "\\tmp\\", "\\Public\\", "\\ProgramData\\",
"\\Windows\\Temp\\", "\\AppData\\Local\\Temp\\",
"\\inetpub\\wwwroot\\", "\\wwwroot\\",
"\\Users\\Public\\", "\\Recycle", "\\$Recycle"
]);
let StagingTools = dynamic([
"xcopy", "robocopy", "copy", "move", "compress-archive",
"zip", "7z", "rar", "tar", "compact"
]);
let LargeFileExtensions = dynamic([
".zip", ".rar", ".7z", ".tar", ".gz", ".bz2",
".cab", ".iso", ".lzh", ".arj"
]);
// Detection 1: Large archive files created in staging-like directories
let ArchiveInStagingDir = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has_any (StagingPaths)
| where FileName has_any (LargeFileExtensions)
| project Timestamp, DeviceName, AccountName, FolderPath, FileName,
FileSize, InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, DetectionType = "ArchiveInStagingDir";
// Detection 2: xcopy/robocopy copying to remote UNC paths
let RemoteCopyTool = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("xcopy.exe", "robocopy.exe", "copy") or
ProcessCommandLine has_any ("xcopy", "robocopy")
| where ProcessCommandLine has "\\\\"
| where ProcessCommandLine matches regex @"\\\\\\.+\\"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
DetectionType = "RemoteCopyToUNCPath";
// Detection 3: PowerShell/cmd copying to remote shares
let PSRemoteCopy = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe")
| where ProcessCommandLine has_any ("copy", "xcopy", "robocopy", "Move-Item", "Copy-Item")
| where ProcessCommandLine has "\\\\"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
DetectionType = "PSCmdRemoteCopy";
// Union all detections
ArchiveInStagingDir
| union RemoteCopyTool
| union PSRemoteCopy
| sort by Timestamp descDetects remote data staging activity across multiple vectors using Microsoft Defender for Endpoint tables. Three sub-queries are unioned: (1) archive files created in common staging directories (Temp, Public, ProgramData, wwwroot), (2) xcopy/robocopy processes copying files to UNC/remote paths, and (3) PowerShell or cmd.exe executing file copy commands targeting remote shares. The detection covers the most common patterns used by threat actors (Chimera, ToddyCat, FIN6, menuPass) when aggregating collected data on a staging host.
Data Sources
Required Tables
False Positives & Tuning
- IT backup solutions (Veeam, Backup Exec, Windows Server Backup) legitimately copy large volumes of files to remote UNC shares on a scheduled basis
- Software deployment tools (SCCM, Intune, PDQ Deploy) using robocopy or xcopy to distribute installers to staging directories across the environment
- Developers or build systems copying compiled artifacts to shared network paths (CI/CD pipelines using MSBuild, Jenkins agents)
- System administrators running manual robocopy/xcopy migration jobs during server decommissions or data migrations
- Antivirus or DLP solutions quarantining files to a centralized staging directory
Other platforms for T1074.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Stage Files to Remote SMB Share via xcopy
Expected signal: Sysmon Event ID 1: Process Create for xcopy.exe with CommandLine containing UNC path '\\127.0.0.1\StagingTest$'. Sysmon Event ID 11: File Create events on the destination share. Security Event ID 5140 (if share auditing enabled): Network share 'StagingTest$' accessed. Security Event ID 4688 (if command line auditing enabled): xcopy.exe process creation with full command line.
- Test 2Archive and Stage Collected Files in Public Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\Users\Public'. Sysmon Event ID 11: File Create event for the .zip file in C:\Users\Public\staging_test\. PowerShell ScriptBlock Logging Event ID 4104: Records the Compress-Archive command.
- Test 3Stage Data in Web-Accessible Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\inetpub\wwwroot'. Sysmon Event ID 11: File Create event for the .zip file in C:\inetpub\wwwroot\uploads\. PowerShell ScriptBlock Logging Event ID 4104 with full command.
- Test 4Remote Staging via PowerShell Copy-Item to UNC Path
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Copy-Item' and '\\127.0.0.1\RemoteStage$'. Sysmon Event ID 11: File Create events on the destination share path. Sysmon Event ID 3: Network connection from powershell.exe to 127.0.0.1 on port 445 (SMB). Security Event ID 5140 (if share auditing enabled): Network share access event.
References (15)
- https://attack.mitre.org/techniques/T1074/002/
- https://www.mandiant.com/sites/default/files/2021-09/mtrends-2020.pdf
- https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
- https://www.secureworks.com/research/bronze-union
- https://www.fireeye.com/content/dam/fireeye-www/summit/ciso-summit-2016/cs16-know-your-enemy-fin8.pdf
- https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-fin6.pdf
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200a
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF
- https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/
- https://securelist.com/toddycat-check-logs/110696/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/xcopy
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1074.002/T1074.002.md
Unlock Pro Content
Get the full detection package for T1074.002 including response playbook, investigation guide, and atomic red team tests.