What problem does it solve?
Adversaries typically stage collected files in a central location (MITRE ATT&CK T1074) before exfiltrating them, and security teams often miss this activity because they only watch for archive tools while attackers use renamed binaries or plain copy commands. This Skill provides a structured hunting procedure to surface staging behavior from EDR and Sysmon telemetry before data leaves the environment.
Core Features & Use Cases
- Archive Tool Detection: Monitor process creation events for 7z.exe, rar.exe, tar, zip, and WinRAR, including renamed binaries matched via OriginalFileName and hashes.
- Staging Directory Analysis: Flag file writes to common staging paths such as %TEMP%, ProgramData, the Recycle Bin, and hidden directories, plus large file consolidation patterns.
- Risk Scoring and Reporting: Score staging events by archive size, source diversity, path suspicion, and timing, then produce a JSON report with MITRE ATT&CK mapping (T1074.001, T1074.002, T1560).
- Use Case: A SOC analyst investigating a suspected breach runs this hunt against Sysmon Event ID 1 and 11 logs to find a burst of file writes into C:\Windows\Temp followed by encrypted 7-Zip archive creation, confirming data staging before exfiltration.
Quick Start
Hunt for data staging activity in my Sysmon process creation and file creation logs and generate a risk-scored report mapped to MITRE ATT&CK T1074.
