Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-ArchiveStaging-ScheduledExfil.
Upgrade to ProDetect Scheduled Batch Exfiltration of Compressed Archive Staging in Splunk
Double-extortion ransomware affiliates routinely stage stolen data into password-protected, multi-volume compressed archives before transferring it off-network, and increasingly schedule that transfer to run in a single batch during off-hours or maintenance windows to minimise the chance of SOC observation and to blend with legitimate scheduled backup jobs. LockBit and BlackCat/ALPHV affiliates have been documented staging data with commands such as `rar.exe a -v500m -hp<password>` (password-protected, 500MB split volumes) and then invoking a transfer tool (rclone, MEGAcmd, curl/SFTP) via a Scheduled Task created specifically for the operation, timed to run during low-traffic overnight hours. Cl0p's mass-exploitation campaigns (e.g., the 2023 MOVEit Transfer exploitation) similarly relied on automated, scripted batch retrieval of staged data at scale rather than interactive, ad hoc transfers, timing collection to minimise operational footprint. This detection targets the composite chain rather than any single step in isolation: (1) an archive utility creating multiple password-protected, size-limited volumes — the staging signature; (2) a Scheduled Task created around the same time, referencing either the archive path/extension or a known transfer tool — the scheduling signature; and (3) network egress from the same host at the scheduled time to a known exfiltration-capable destination. Correlating all three within a short window is a much higher-fidelity indicator of T1029 Scheduled Transfer than any one signal alone, since each individual step (archiving, task scheduling, network egress) has abundant legitimate uses on its own.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
(Image IN ("*\\rar.exe","*\\winrar.exe","*\\7z.exe","*\\7za.exe") AND (CommandLine="*-v*" OR CommandLine="*-hp*" OR CommandLine="*-p*"))
OR (Image="*\\schtasks.exe" AND CommandLine="*/create*" AND (CommandLine="*rclone*" OR CommandLine="*megacmd*" OR CommandLine="*.rar*" OR CommandLine="*.7z*"))
)
| eval Signal=case(
match(Image, "(?i)(rar|7z)"), "ArchiveStaging",
match(Image, "(?i)schtasks"), "ScheduledTaskCreate",
true(), "Other"
)
| append
[ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698
| eval Signal="ScheduledTaskCreate_4698" ]
| stats count AS Events, values(CommandLine) AS Commands BY host, User, Image, Signal
| sort - EventsSPL detection covering both the archive-staging and scheduled-task-creation signals: Sysmon process creation for split-volume/password-protected archive commands, schtasks.exe /create referencing transfer tools or archive files, and — as a higher-fidelity alternative to relying solely on schtasks.exe process execution — native Windows Security Event ID 4698 (A scheduled task was created), which captures the task creation even when schtasks.exe itself is not the mechanism used (e.g., programmatic Task Scheduler API calls).
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate password-protected archive creation for authorised external data transfer (vendor evidence bundles, database export handoffs)
- Automation platforms (SCCM, Intune, Ansible) creating scheduled tasks that reference approved transfer tooling
Other platforms for THREAT-ArchiveStaging-ScheduledExfil
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Archive Staging and Scheduled Off-Hours Exfiltration
Expected signal: Sysmon Event ID 1: rar.exe with -v and -hp flags; Sysmon Event ID 1 for schtasks.exe /create referencing curl.exe; Windows Security Event ID 4698 for the created task.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-ArchiveStaging-ScheduledExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-CloudCLI-ScheduledExfilScheduled Transfer via Cloud Sync/Backup CLI ToolsUse for cloud CLI LOLBins — rclone, restic or azcopy launched by a scheduler rather than a human.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.