Which SIEM platforms have a THREAT-ArchiveStaging-ScheduledExfil detection rule?

df00tech provides THREAT-ArchiveStaging-ScheduledExfil (Scheduled Batch Exfiltration of Compressed Archive Staging) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-ArchiveStaging-ScheduledExfil detection?

The THREAT-ArchiveStaging-ScheduledExfil detection is rated critical severity with medium confidence.

What are common false positives for THREAT-ArchiveStaging-ScheduledExfil?

Common false positives for THREAT-ArchiveStaging-ScheduledExfil include: IT operations creating password-protected split archives for legitimate large-file transfer to a vendor or partner (common for sending encrypted evidence bundles, log exports, or database dumps); Backup software that internally uses 7-Zip/WinRAR with split-volume options as part of its archival routine; Scheduled Tasks created by legitimate automation (Ansible/SCCM/Intune-deployed scripts) that happen to reference file transfer tools for authorised data movement.

THREAT-ArchiveStaging-ScheduledExfil: Scheduled Transfer — Scheduled Batch Exfiltration of Compressed Archive Staging — Detection (KQL, SPL, Sigma + 5 SIEMs)

Q: What data sources are required to detect Scheduled Batch Exfiltration of Compressed Archive Staging (THREAT-ArchiveStaging-ScheduledExfil)?

Detecting Scheduled Batch Exfiltration of Compressed Archive Staging requires the following data sources: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceNetworkEvents), Sysmon Event ID 1, 3, Windows Security Event ID 4698 (Scheduled Task Created).

Microsoft Sentinel / Defender

kusto

let LookbackWindow = 24h;
let ArchiveTools = dynamic(["rar.exe", "winrar.exe", "7z.exe", "7za.exe"]);
let TransferTools = dynamic(["rclone.exe", "megacmd.exe", "curl.exe", "winscp.exe", "filezilla.exe", "psftp.exe"]);
// Signal 1: password-protected, split-volume archive creation (staging)
let ArchiveStaging = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName has_any (ArchiveTools)
| where ProcessCommandLine has_any ("-v", "-hp") or ProcessCommandLine matches regex @"-p\S+"
| extend Signal = "ArchiveStaging"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;
// Signal 2: scheduled task creation referencing an archive path/extension or a transfer tool
let ScheduledTaskCreate = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has "/create"
| where ProcessCommandLine has_any (TransferTools) or ProcessCommandLine has_any (".rar", ".7z", ".zip")
| extend Signal = "ScheduledTaskCreate"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;
// Signal 3: subsequent network egress from a host that also has Signal 1 or 2, to a known exfil-capable destination
let StagingHosts = (ArchiveStaging | distinct DeviceName);
let TaskHosts = (ScheduledTaskCreate | distinct DeviceName);
let CandidateHosts = StagingHosts | union TaskHosts | distinct DeviceName;
let NetworkEgress = DeviceNetworkEvents
| where Timestamp > ago(LookbackWindow)
| where DeviceName in (CandidateHosts)
| where ActionType =~ "ConnectionSuccess"
| where RemoteUrl has_any ("mega.nz", "mega.io", "dropbox.com", "gofile.io", "transfer.sh", "sendspace.com")
    or InitiatingProcessFileName has_any (TransferTools)
| extend Signal = "NetworkEgressPostStaging"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, FileName=InitiatingProcessFileName,
    ProcessCommandLine=InitiatingProcessCommandLine, Signal;
union ArchiveStaging, ScheduledTaskCreate, NetworkEgress
| sort by DeviceName, Timestamp asc

Correlates the full staged-and-scheduled exfiltration chain: (1) archive utilities (rar.exe, 7z.exe) invoked with split-volume (-v) and password-protection (-hp/-p) flags, the signature of ransomware-affiliate data staging; (2) schtasks.exe /create commands whose arguments reference a known transfer tool or an archive file extension, the signature of the scheduling step; and (3) network egress from any host already flagged by (1) or (2) toward known exfiltration-capable destinations or via known transfer tool processes. Reviewing all three signals together for the same DeviceName within the 24-hour window is the intended triage workflow — a single signal alone is common in legitimate IT operations.

critical severity medium confidence

Data Sources

Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceNetworkEvents) Sysmon Event ID 1, 3 Windows Security Event ID 4698 (Scheduled Task Created)

Required Tables

DeviceProcessEvents DeviceNetworkEvents

False Positives

IT operations creating password-protected split archives for legitimate large-file transfer to a vendor or partner (common for sending encrypted evidence bundles, log exports, or database dumps)
Backup software that internally uses 7-Zip/WinRAR with split-volume options as part of its archival routine
Scheduled Tasks created by legitimate automation (Ansible/SCCM/Intune-deployed scripts) that happen to reference file transfer tools for authorised data movement
Scheduled off-hours batch jobs run by data engineering/analytics teams that both compress and transfer data as part of a documented ETL pipeline

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (Image IN ("*\\rar.exe","*\\winrar.exe","*\\7z.exe","*\\7za.exe") AND (CommandLine="*-v*" OR CommandLine="*-hp*" OR CommandLine="*-p*"))
  OR (Image="*\\schtasks.exe" AND CommandLine="*/create*" AND (CommandLine="*rclone*" OR CommandLine="*megacmd*" OR CommandLine="*.rar*" OR CommandLine="*.7z*"))
)
| eval Signal=case(
    match(Image, "(?i)(rar|7z)"), "ArchiveStaging",
    match(Image, "(?i)schtasks"), "ScheduledTaskCreate",
    true(), "Other"
  )
| append
  [ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698
    | eval Signal="ScheduledTaskCreate_4698" ]
| stats count AS Events, values(CommandLine) AS Commands BY host, User, Image, Signal
| sort - Events

SPL detection covering both the archive-staging and scheduled-task-creation signals: Sysmon process creation for split-volume/password-protected archive commands, schtasks.exe /create referencing transfer tools or archive files, and — as a higher-fidelity alternative to relying solely on schtasks.exe process execution — native Windows Security Event ID 4698 (A scheduled task was created), which captures the task creation even when schtasks.exe itself is not the mechanism used (e.g., programmatic Task Scheduler API calls).

critical severity medium confidence

Data Sources

Sysmon via Windows Event Log Windows Security Event Log

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational WinEventLog:Security

False Positives

Legitimate password-protected archive creation for authorised external data transfer (vendor evidence bundles, database export handoffs)
Automation platforms (SCCM, Intune, Ansible) creating scheduled tasks that reference approved transfer tooling

Elastic Security (EQL)

eql

sequence by host.id with maxspan=24h
  [process where event.type == "start" and
     process.name : ("rar.exe", "winrar.exe", "7z.exe", "7za.exe") and
     process.command_line : ("*-v*", "*-hp*", "*-p*")]
  [process where event.type == "start" and
     process.name : "schtasks.exe" and
     process.command_line : "*/create*" and
     process.command_line : ("*rclone*", "*megacmd*", "*.rar*", "*.7z*")]

Elastic EQL sequence rule correlating, on the same host within a 24-hour window, (1) an archive utility invoked with split-volume/password-protection flags and (2) a subsequent schtasks.exe /create command referencing a transfer tool or archive file. Requiring both events in sequence on the same host.id substantially reduces false positives compared to either signal alone. Maps to MITRE T1029.

critical severity medium confidence

Data Sources

Elastic Endpoint Security Elastic Agent (Endpoint Integration) Winlogbeat with Sysmon

Required Tables

logs-endpoint.events.process-* winlogbeat-*

False Positives

IT operations staging and transferring password-protected archives for legitimate vendor/partner data handoff — exclude by process.user.name against a known service-account allowlist
Backup software internally invoking archive utilities with split-volume flags as part of routine archival jobs — exclude by process.parent.name matching the backup vendor's orchestrator process

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "Command Line" AS CommandLine,
    CASE
        WHEN LOWER("Process Name") LIKE '%rar.exe%' OR LOWER("Process Name") LIKE '%7z.exe%' THEN 'ArchiveStaging'
        WHEN LOWER("Process Name") LIKE '%schtasks.exe%' THEN 'ScheduledTaskCreate'
        ELSE 'Other'
    END AS Signal
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (LOWER("Process Name") LIKE '%rar.exe%' AND (LOWER("Command Line") LIKE '%-v%' OR LOWER("Command Line") LIKE '%-hp%'))
    OR (LOWER("Process Name") LIKE '%7z.exe%' AND (LOWER("Command Line") LIKE '%-v%' OR LOWER("Command Line") LIKE '%-p%'))
    OR (LOWER("Process Name") LIKE '%schtasks.exe%' AND LOWER("Command Line") LIKE '%/create%'
        AND (LOWER("Command Line") LIKE '%rclone%' OR LOWER("Command Line") LIKE '%.rar%' OR LOWER("Command Line") LIKE '%.7z%'))
  )
  AND starttime > NOW() - 86400000
ORDER BY hostname, starttime ASC
LIMIT 500

QRadar AQL query surfacing both the archive-staging and scheduled-task-creation signals from Windows Security Event Log and Sysmon sources, ordered by host and time so an analyst can visually confirm both signals occurring on the same host in sequence. Requires WinCollect or a Universal DSM exposing 'Process Name' and 'Command Line' custom event properties; pair with a QRadar building block/rule requiring both signals within a 24-hour window per hostname for automated correlation.

critical severity medium confidence

Data Sources

IBM QRadar SIEM Microsoft Windows Security Event Log (via WinCollect) Sysmon Events (via WinCollect or Universal DSM)

Required Tables

events

False Positives

Legitimate vendor data handoff via password-protected archives — whitelist known service accounts in a QRadar reference set
Backup software scheduled tasks referencing archive utilities as part of routine jobs — exclude by known backup orchestrator process names

Sumo Logic CSE

sql

(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=1
| where (Image matches "*rar.exe" OR Image matches "*7z.exe") AND (CommandLine matches "*-v*" OR CommandLine matches "*-hp*" OR CommandLine matches "*-p*")
    OR (Image matches "*schtasks.exe" AND CommandLine matches "*/create*" AND (CommandLine matches "*rclone*" OR CommandLine matches "*.rar*" OR CommandLine matches "*.7z*"))
| eval Signal = if(Image matches "*schtasks*", "ScheduledTaskCreate", "ArchiveStaging")
| stats count AS Events, values(CommandLine) AS Commands, min(_messagetime) AS FirstSeen, max(_messagetime) AS LastSeen BY ComputerName, User, Signal
| sort BY ComputerName

Sumo Logic search identifying both the archive-staging and scheduled-task-creation signals via Windows Sysmon process creation events, grouped by host and signal type with first/last-seen timestamps so an analyst can confirm whether both signals occurred on the same host in the expected staging-then-scheduling order.

critical severity medium confidence

Data Sources

Sumo Logic Cloud SIEM Windows Sysmon (via Sumo Logic Installed Collector)

Required Tables

_sourceCategory=windows/sysmon

False Positives

IT operations staging password-protected archives for approved vendor data transfer — maintain a Sumo Logic lookup table of authorised service accounts
Backup software scheduled tasks referencing archive tooling as part of routine jobs

Google Chronicle / SecOps

yaral

rule scheduled_archive_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects archive staging paired with scheduled task creation referencing a transfer tool, indicating scheduled batch exfiltration"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1029"
    threat_actors = "LockBit, BlackCat (ALPHV), Cl0p"
    reference = "https://attack.mitre.org/techniques/T1029/"

  events:
    $stage.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($stage.target.process.file.full_path, `(?i)(rar|7z)(\.exe)?$`)
    re.regex($stage.target.process.command_line, `(?i)(-v\d|-hp|-p\S)`)

    $task.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($task.target.process.file.full_path, `(?i)schtasks\.exe$`)
    re.regex($task.target.process.command_line, `(?i)/create`)
    re.regex($task.target.process.command_line, `(?i)(rclone|megacmd|\.rar|\.7z)`)

    $hostname = $stage.principal.hostname
    $hostname = $task.principal.hostname

  match:
    $hostname over 24h

  condition:
    $stage and $task
}

Chronicle YARA-L 2.0 rule correlating two PROCESS_LAUNCH events on the same hostname within a 24-hour window: a password-protected/split-volume archive utility invocation, and a subsequent schtasks.exe /create referencing a transfer tool or archive file. Requiring the join on $hostname is what gives this rule higher precision than either signal alone.

critical severity medium confidence

Data Sources

Google Chronicle SIEM Chronicle UDM (Unified Data Model) Chronicle Forwarder (Windows Events)

Required Tables

UDM Events (PROCESS_LAUNCH)

False Positives

Approved vendor data handoff via password-protected archives and a scheduled transfer task — maintain a Chronicle reference list of authorised service accounts and exclude via principal.user.userid
Backup software orchestrating archive-then-schedule jobs as routine operations

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)(rar|7z)(\.exe)?$/ AND CommandLine=/(?i)(-v\d|-hp|-p\S)/
  OR (ImageFileName=/(?i)schtasks\.exe$/ AND CommandLine=/(?i)\/create/ AND CommandLine=/(?i)(rclone|megacmd|\.rar|\.7z)/)
| Signal := case {
    ImageFileName=/(?i)schtasks/ => "ScheduledTaskCreate";
    * => "ArchiveStaging"
  }
| groupBy([ComputerName, UserName, Signal], function=[count(as=EventCount), collect(CommandLine, limit=10), min(field=@timestamp, as=FirstSeen)])
| sort(field=ComputerName, order=asc)

CrowdStrike LogScale (Falcon) query using ProcessRollup2 telemetry to surface both the archive-staging and scheduled-task-creation signals, grouped by host and signal type with first-seen timestamps so an analyst can confirm the expected staging-then-scheduling sequence on the same host.

critical severity medium confidence

Data Sources

CrowdStrike Falcon Endpoint Protection CrowdStrike LogScale Falcon ProcessRollup2 Telemetry

Required Tables

ProcessRollup2

False Positives

Authorised vendor data handoff via password-protected archives and scheduled transfer — tag known service-account hosts with a Falcon host group and exclude
Backup software scheduled tasks that reference archive tooling as part of routine, approved jobs

Scheduled Transfer — Scheduled Batch Exfiltration of Compressed Archive Staging

What is THREAT-ArchiveStaging-ScheduledExfil Scheduled Batch Exfiltration of Compressed Archive Staging?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-ArchiveStaging-ScheduledExfil

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (3)

Parent Technique

Related Techniques

Same Tactic: Exfiltration

Popular Detections

What is THREAT-ArchiveStaging-ScheduledExfil Scheduled Batch Exfiltration of Compressed Archive Staging?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-ArchiveStaging-ScheduledExfil

Testing Methodology

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (3)

Parent Technique

Related Techniques

Same Tactic: Exfiltration

Popular Detections

Get new detections in your inbox