T1074.001 Local Data Staging — Detection Rules

Source-backed rule directory

• Zip A Folder With PowerShell For Staging In Temp - PowerShell · test · medium · {"product":"windows","service":"powershell-classic"}
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Module · test · medium · {"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"}
• Zip A Folder With PowerShell For Staging In Temp - PowerShell Script · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet · test · medium · {"product":"windows","category":"process_creation"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0261 Detection of Local Data Staging Prior to Exfiltration

AN0724 Analytic 0724

Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior.

AN0725 Analytic 0725

Detects aggregation of files from different directories into /tmp, /mnt, or user-specified directories with archiving tools like tar or gzip.

AN0726 Analytic 0726

Detects staged data aggregated in /Users/Shared, /private/tmp with compression tools like ditto or zip, initiated via Terminal or AppleScript.

AN0727 Analytic 0727

Detects local staging behavior via snapshot creation or files written into VMFS partitions by scripts or unauthorized shell access.