Detection of Local Data Staging Prior to Exfiltration, Detection Strategy DET0261
Excerpt
AN0724
Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior.
Log Sources
Mutable Elements
Field Description
StagingDirList Paths such as C:\Temp, C:\Windows\Tasks, etc.
ArchivingToolPatterns Matches to 7z.exe, rar.exe, zip.exe, or custom scripts. TimeWindow How long to correlate file reads followed by compression.
AN0725
Detects aggregation of files from different directories into /tmp, /mnt, or user-specified directories with archiving tools like tar or gzip.
Log Sources
Mutable Elements
Field Description
StagingDirs e.g., /tmp, /var/tmp, custom user dirs
Arc…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by MITRE ATT&CK on attack.mitre.org.
More from MITRE ATT&CK43
- techdoc_lite-deliverables-numbered option.dotxMITRE ATT&CK · Added 16 Jun
- Cross-Platform Detection of Data Transfer to Cloud Account, Detection Strategy DET0573MITRE ATT&CK · Added 6 Apr
- Encrypted Channel, Technique T1573 - EnterpriseMITRE ATT&CK · Added 6 Apr
- Boot or Logon Autostart Execution: Time Providers, Sub-technique T1547.003 - EnterpriseMITRE ATT&CK · Added 6 Apr
