T1074.002 — Remote Data Staging

Tactic: Collection · Platforms: ESXi, IaaS, Linux, macOS, Windows

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data. Interactive command shells may be used, and common…

Sub-technique of Data Staged (T1074).

Sigma detection rules (5)

title: "T1074.002 Data Staged: Remote Data Staging"
id: ed103a7c-9594-4e63-90ea-c7aabc13da95
description: 'Detects archive-extension files or copy/archive tool activity in common staging directories. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: StagingDirectory, RemotePathPatterns, CopyToolPatterns.'
references:
  - https://attack.mitre.org/techniques/T1074/002
author: Shahrukh Khan
date: 2026-04-13
license: MIT
tags:
  - attack.collection
  - attack.t1074.002

logsource:
  category: file_create
  product: windows
  service: sysmon

detection:
  selection_staging_path:
    EventID: '11'
    TargetFilename|contains:
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - '\$Recycle.Bin\'
  selection_archive_ext:
    TargetFilename|endswith:
      - '.zip'
      - '.rar'
      - '.7z'
      - '.tar'
      - '.gz'
  selection_copy_tool:
    Image|endswith:
      - '\robocopy.exe'
      - '\xcopy.exe'
      - '\rclone.exe'
      - '\7z.exe'
      - '\winrar.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_staging_path and (selection_archive_ext or selection_copy_tool) and not filter_system_account

falsepositives:
  - Legitimate backup/archival jobs.

level: medium

title: "T1074.002 Data Staged: Remote Data Staging"
id: 81c06889-44a0-4f17-aa43-180b94b0c1e4
description: 'Detection of Remote Data Staging Prior to Exfiltration via rsync/scp pulling data from remote hosts into a local staging path. (Retargeted: the previous rule let a bare rsync or mount EXECVE fire on its own regardless of argv position, so ordinary local mounts and non-remote rsync usage matched; this version requires the remote host/user@host: or host:: syntax to appear in ANY early argv position -- not a hardcoded a1 -- since flags like -avz/-e shift the remote target to a1/a2/a3 depending on invocation.) Tune using: RemoteHosts, StagingDirectories, TransferVolumeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1074/002
author: Shahrukh Khan
date: 2026-04-20
license: MIT
tags:
  - attack.collection
  - attack.t1074.002

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_rsync:
    type: EXECVE
    a0|endswith: '/rsync'
  selection_scp:
    type: EXECVE
    a0|endswith: '/scp'
  selection_remote_syntax:
    - a1|re: '.*@.*:.*|.*::.*'
    - a2|re: '.*@.*:.*|.*::.*'
    - a3|re: '.*@.*:.*|.*::.*'
    - a4|re: '.*@.*:.*|.*::.*'
    - a5|re: '.*@.*:.*|.*::.*'

  condition: (selection_rsync or selection_scp) and selection_remote_syntax

falsepositives:
  - rsync and scp are used constantly for legitimate remote backups, config management pulls, and file synchronization; the transfer-volume threshold noted in tuning fields must be applied SIEM-side since auditd doesn't record byte counts for these syscalls.

level: low

title: "T1074.002 Data Staged: Remote Data Staging"
id: c014344d-3419-4c03-bfbd-2afb4d752283
description: 'Detection of Remote Data Staging Prior to Exfiltration. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: StagingPaths, CompressionIndicators, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1074/002
author: Shahrukh Khan
date: 2026-02-07
license: MIT
tags:
  - attack.collection
  - attack.t1074.002

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Shared/'
      - '/Volumes/'
    TargetFilename|endswith:
      - '.zip'
      - '.tar.gz'
      - '.dmg'

  condition: selection

falsepositives:
  - Legitimate file sharing to mounted network volumes creates similarly named archive files.

level: medium

title: "T1074.002 Data Staged: Remote Data Staging"
id: ac3a1ea4-92a5-4a63-b8d5-4c9cdf6a86d2
description: 'Detection of Remote Data Staging Prior to Exfiltration. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BucketNamePatterns, IAMContext, TransferWindow.'
references:
  - https://attack.mitre.org/techniques/T1074/002
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.collection
  - attack.t1074.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection_cross_account_policy:
    eventSource: 's3.amazonaws.com'
    eventName: 'PutBucketPolicy'
    requestParameters.bucketPolicy|contains: '"AWS": "arn:aws:iam::'
  selection_copy_out:
    eventSource: 's3.amazonaws.com'
    eventName: 'CopyObject'
    requestParameters.destinationBucketName|exists: true

  condition: selection_cross_account_policy or selection_copy_out

falsepositives:
  - Intentional cross-account data-sharing arrangements between related business units will match the bucket policy selection, so verify the granted account ID against an approved partner list.

level: high

title: "T1074.002 Data Staged: Remote Data Staging"
id: d73e5600-87d7-4cc3-82ea-e5489ec2fba9
description: 'Detection of Remote Data Staging Prior to Exfiltration. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SnapshotFrequency, RemoteWriteVolume, StorageMountPaths.'
references:
  - https://attack.mitre.org/techniques/T1074/002
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.collection
  - attack.t1074.002

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: 'Datastore'
  selection_mount:
    Message|contains:
      - 'mounted'
      - 'NFS'

  condition: selection and selection_mount

falsepositives:
  - Legitimate addition of shared NFS or VMFS datastores for normal storage expansion will also generate these events.

level: low

Related sub-techniques

• T1074.001 Local Data Staging

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1074.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan