Which SIEM platforms have a T1074.002 detection rule?

df00tech provides T1074.002 (Remote Data Staging) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the T1074.002 detection?

The T1074.002 detection is rated high severity with medium confidence.

What are common false positives for T1074.002?

Common false positives for T1074.002 include: IT backup solutions (Veeam, Backup Exec, Windows Server Backup) legitimately copy large volumes of files to remote UNC shares on a scheduled basis; Software deployment tools (SCCM, Intune, PDQ Deploy) using robocopy or xcopy to distribute installers to staging directories across the environment; Developers or build systems copying compiled artifacts to shared network paths (CI/CD pipelines using MSBuild, Jenkins agents).

T1074.002 Splunk · SPL

Detect Remote Data Staging in Splunk

Q: What data sources are required to detect Remote Data Staging (T1074.002)?

Detecting Remote Data Staging requires the following data sources: File: File Creation, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint.

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location. By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.

MITRE ATT&CK

Tactic: Collection
Technique: T1074 Data Staged
Sub-technique: T1074.002 Remote Data Staging
Canonical reference: https://attack.mitre.org/techniques/T1074/002/

SPL Detection Query

Splunk (SPL)

spl

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11))
| eval EventType=case(
    EventCode=1, "ProcessCreate",
    EventCode=11, "FileCreate",
    true(), "Unknown"
  )
| eval IsStagingPath=if(
    match(coalesce(TargetFilename, Image), "(?i)(\\\\temp\\\\|\\\\tmp\\\\|\\\\public\\\\|\\\\programdata\\\\|\\\\inetpub\\\\wwwroot\\\\|\\\\wwwroot\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\users\\\\public\\\\)"),
    1, 0)
| eval IsArchiveFile=if(
    match(lower(coalesce(TargetFilename, "")), "(\.zip|\.rar|\.7z|\.tar|\.gz|\.cab|\.iso|\.bz2)$"),
    1, 0)
| eval IsRemoteCopyTool=if(
    EventCode=1 AND match(lower(Image), "(xcopy\.exe|robocopy\.exe)"),
    1, 0)
| eval IsUNCTarget=if(
    EventCode=1 AND match(CommandLine, "\\\\\\\\[a-zA-Z0-9]"),
    1, 0)
| eval IsPSCopy=if(
    EventCode=1 AND match(lower(Image), "(powershell\.exe|pwsh\.exe|cmd\.exe)") AND
    match(lower(CommandLine), "(copy-item|move-item|xcopy|robocopy|copy\s|move\s)") AND
    match(CommandLine, "\\\\\\\\[a-zA-Z0-9]"),
    1, 0)
| eval StagingScore = IsStagingPath + IsArchiveFile + IsRemoteCopyTool + IsUNCTarget + IsPSCopy
| where StagingScore >= 1
| eval DetectionType=case(
    IsArchiveFile=1 AND IsStagingPath=1, "ArchiveInStagingDir",
    IsRemoteCopyTool=1 AND IsUNCTarget=1, "RemoteCopyToolToUNC",
    IsPSCopy=1, "PSCmdRemoteCopy",
    IsArchiveFile=1, "ArchiveFileCreated",
    IsStagingPath=1, "FileInStagingDir",
    true(), "OtherStagingIndicator"
  )
| table _time, host, User, Image, CommandLine, TargetFilename, ParentImage, ParentCommandLine,
        IsStagingPath, IsArchiveFile, IsRemoteCopyTool, IsUNCTarget, IsPSCopy,
        StagingScore, DetectionType, EventType
| sort - StagingScore, - _time

high severity medium confidence

Detects remote data staging activity using Sysmon Event ID 1 (Process Create) and Event ID 11 (File Create). Assigns a cumulative staging score based on five indicators: file creation in staging directories, archive file extensions, use of xcopy/robocopy tools, UNC path targets in command lines, and PowerShell/cmd file copy commands targeting remote shares. Higher scores indicate stronger evidence of malicious staging. Detection types are labeled for analyst triage.

Data Sources

File: File CreationProcess: Process CreationCommand: Command ExecutionSysmon Event ID 1Sysmon Event ID 11

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

IT backup solutions (Veeam, Backup Exec, Windows Server Backup) legitimately copy large volumes of files to remote UNC shares on a scheduled basis
Software deployment tools (SCCM, Intune, PDQ Deploy) using robocopy or xcopy to distribute installers to staging directories across the environment
Developers or build systems copying compiled artifacts to shared network paths (CI/CD pipelines using MSBuild, Jenkins agents)
System administrators running manual robocopy/xcopy migration jobs during server decommissions or data migrations
Antivirus or DLP solutions quarantining files to a centralized staging directory

Download portable Sigma rule (.yml)

Other platforms for T1074.002

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Stage Files to Remote SMB Share via xcopy
Expected signal: Sysmon Event ID 1: Process Create for xcopy.exe with CommandLine containing UNC path '\\127.0.0.1\StagingTest$'. Sysmon Event ID 11: File Create events on the destination share. Security Event ID 5140 (if share auditing enabled): Network share 'StagingTest$' accessed. Security Event ID 4688 (if command line auditing enabled): xcopy.exe process creation with full command line.
Test 2Archive and Stage Collected Files in Public Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\Users\Public'. Sysmon Event ID 11: File Create event for the .zip file in C:\Users\Public\staging_test\. PowerShell ScriptBlock Logging Event ID 4104: Records the Compress-Archive command.
Test 3Stage Data in Web-Accessible Directory
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Compress-Archive' and 'C:\inetpub\wwwroot'. Sysmon Event ID 11: File Create event for the .zip file in C:\inetpub\wwwroot\uploads\. PowerShell ScriptBlock Logging Event ID 4104 with full command.
Test 4Remote Staging via PowerShell Copy-Item to UNC Path
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Copy-Item' and '\\127.0.0.1\RemoteStage$'. Sysmon Event ID 11: File Create events on the destination share path. Sysmon Event ID 3: Network connection from powershell.exe to 127.0.0.1 on port 445 (SMB). Security Event ID 5140 (if share auditing enabled): Network share access event.

Last updated: 2026-04-13 Research depth: deep

References (15)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1074.002 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Remote Data Staging in Splunk

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1074.002

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Collection

Popular Detections

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1074.002

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Collection

Popular Detections

Get new detections in your inbox