Data Staged T1074

Tactic: Collection

Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

Events covered

9 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 32 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (40 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine8regex_match 4, contains 2, match 2, wildcard 1 copy, cp , move, (?i)(\s+|\;|\:\,|\d+|\|)(out-file|\>{1,2})(\s|\;|\:\,\|).{1,}, (?i)(\s+|\;|\:\,|\d+|\|)?(\>{1,2})(\s|\;|\:\,\|).{1,}|\s+>
EventID8eq 84688, 4104, 4103, 5145, CREATE_DATA_TRANSFER_REQUEST
EventType6eq 4, in 2exec, modification, CREATE_DATA_TRANSFER_REQUEST, CUSTOMER_TAKEOUT_CREATED, CreateTrafficMirrorSession
event.type6eq 5, in 1creation, start, change
process_name5eq 2, in 2, starts_with 1arch, cmd.exe, csrutil, dscl, openssl
TargetFilename4wildcard 3, starts_with 1/library/fonts/*, /library/graphics/*, /*/.*, /dev/shm/*, /library/webserver/*
CsUsername3is_not_null 3
data_stream.dataset3eq 3aws.cloudtrail, google_workspace.admin
host.os.type3eq 3
Provider_Name2eq 2ec2.amazonaws.com, rds.amazonaws.com
ScBytes2gt 20
ScriptBlockText2eq 1, in 1, match 1-filepath, -identity, -mailbox, compress-archive -path*-destinationpath $env:temp, compress-archive -path*-destinationpath*:\windows\temp\
Type2eq 2
event.outcome2eq 2success
file.extension2eq 1, in 10, 1, 2, gz, gzip

Top indicator values (182 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
EventIDeq
4688
4313
EventIDeq
4104
3268
TargetFilenamewildcard
/tmp/*
37
TargetFilenamewildcard
/library/fonts/*
23
TargetFilenamewildcard
/library/graphics/*
23
TargetFilenamewildcard
/library/webserver/*
23
TargetFilenamewildcard
/private/tmp/*
23
TargetFilenamewildcard
/private/var/root/library/httpstorages/*
22
TargetFilenamewildcard
/users/shared/*
24
TargetFilenamewildcard
/var/tmp/*
26
event.typeeq
start
3606
event.typeeq
creation
245
EventTypeeq
modification
215
ScBytesgt
0
22
data_stream.dataseteq
aws.cloudtrail
2141
event.outcomeeq
success
2251
CommandLinecontains
copy
1
CommandLinecontains
cp
18
CommandLinecontains
move
1
CommandLinecontains
mv
14
CommandLinecontains
lsquarantine
1
CommandLinematch
(?i)cmd(\.exe)?.*\s+/c\s+
1
CommandLinematch
Compress-Archive -Path*-DestinationPath $env:TEMP
1
CommandLinematch
Compress-Archive -Path*-DestinationPath*:\Windows\Temp\
1
CommandLinematch
Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\
1
CommandLineregex_match
(?i)(\s+|\;|\:\,|\d+|\|)(out-file|\>{1,2})(\s|\;|\:\,\|).{1,}
1
CommandLineregex_match
(?i)(\s+|\;|\:\,|\d+|\|)?(\>{1,2})(\s|\;|\:\,\|).{1,}|\s+>
1
CommandLineregex_match
(?i)Compress-Archive|tar|makecab|compact|System\.IO\.Compression
1
CommandLineregex_match
(?i)\s(\>(\>)?|Out\-File)\s.{1,}\.\w{2,5}
1
CommandLinewildcard
*\\*\*$*
1

Exclusions (11 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
CommandLineregex_match
(Decompress)
1
TargetFilenamestarts_with
/library/logs/crashreporter/
1
TargetFilenamestarts_with
/private/tmp/publish.
1
TargetFilenamewildcard
/private/tmp/*.fifo
1
TargetFilenamewildcard
/private/tmp/tcl-tk*
1
TargetFilenamewildcard
?:\$recycle.bin\*\*
1
file.nameeq
desktop.ini
1
file.namein
System.keychain
1
file.namein
com.apple.TimeMachine.plist
1
file.namein
login.keychain-db
1
file.namein
preferences.plist
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 5 rules

Elastic 11 rules

Splunk 11 rules

Kusto 3 rules

YARA-L 1 rule

Panther 1 rule