Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-ArchiveStaging-ScheduledExfil.
Upgrade to ProDetect Scheduled Batch Exfiltration of Compressed Archive Staging in Sumo Logic CSE
Double-extortion ransomware affiliates routinely stage stolen data into password-protected, multi-volume compressed archives before transferring it off-network, and increasingly schedule that transfer to run in a single batch during off-hours or maintenance windows to minimise the chance of SOC observation and to blend with legitimate scheduled backup jobs. LockBit and BlackCat/ALPHV affiliates have been documented staging data with commands such as `rar.exe a -v500m -hp<password>` (password-protected, 500MB split volumes) and then invoking a transfer tool (rclone, MEGAcmd, curl/SFTP) via a Scheduled Task created specifically for the operation, timed to run during low-traffic overnight hours. Cl0p's mass-exploitation campaigns (e.g., the 2023 MOVEit Transfer exploitation) similarly relied on automated, scripted batch retrieval of staged data at scale rather than interactive, ad hoc transfers, timing collection to minimise operational footprint. This detection targets the composite chain rather than any single step in isolation: (1) an archive utility creating multiple password-protected, size-limited volumes — the staging signature; (2) a Scheduled Task created around the same time, referencing either the archive path/extension or a known transfer tool — the scheduling signature; and (3) network egress from the same host at the scheduled time to a known exfiltration-capable destination. Correlating all three within a short window is a much higher-fidelity indicator of T1029 Scheduled Transfer than any one signal alone, since each individual step (archiving, task scheduling, network egress) has abundant legitimate uses on its own.
MITRE ATT&CK
- Tactic
- Exfiltration
Sumo Detection Query
(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=1
| where (Image matches "*rar.exe" OR Image matches "*7z.exe") AND (CommandLine matches "*-v*" OR CommandLine matches "*-hp*" OR CommandLine matches "*-p*")
OR (Image matches "*schtasks.exe" AND CommandLine matches "*/create*" AND (CommandLine matches "*rclone*" OR CommandLine matches "*.rar*" OR CommandLine matches "*.7z*"))
| eval Signal = if(Image matches "*schtasks*", "ScheduledTaskCreate", "ArchiveStaging")
| stats count AS Events, values(CommandLine) AS Commands, min(_messagetime) AS FirstSeen, max(_messagetime) AS LastSeen BY ComputerName, User, Signal
| sort BY ComputerNameSumo Logic search identifying both the archive-staging and scheduled-task-creation signals via Windows Sysmon process creation events, grouped by host and signal type with first/last-seen timestamps so an analyst can confirm whether both signals occurred on the same host in the expected staging-then-scheduling order.
Data Sources
Required Tables
False Positives & Tuning
- IT operations staging password-protected archives for approved vendor data transfer — maintain a Sumo Logic lookup table of authorised service accounts
- Backup software scheduled tasks referencing archive tooling as part of routine jobs
Other platforms for THREAT-ArchiveStaging-ScheduledExfil
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Archive Staging and Scheduled Off-Hours Exfiltration
Expected signal: Sysmon Event ID 1: rar.exe with -v and -hp flags; Sysmon Event ID 1 for schtasks.exe /create referencing curl.exe; Windows Security Event ID 4698 for the created task.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-ArchiveStaging-ScheduledExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (3)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.
- THREAT-CloudCLI-ScheduledExfilScheduled Transfer via Cloud Sync/Backup CLI ToolsUse for cloud CLI LOLBins — rclone, restic or azcopy launched by a scheduler rather than a human.
- THREAT-Exfil-ScheduledBulkTransferScheduled Off-Hours Bulk Data TransferUse for network-side detection — off-hours bulk-volume NetFlow, when you have no endpoint scheduler visibility.
- THREAT-Exfiltration-LinuxCronScheduledExfilScheduled Data Exfiltration via Linux Cron JobsUse for Linux hosts — cron/systemd-timer job creation correlated with auditd execution and outbound transfer.