1200KM / detection
T1074.002 Remote Data Staging — Detection Rules
Detection workspace for T1074.002 Remote Data Staging: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0071 Detection of Remote Data Staging Prior to Exfiltration
AN0194 Analytic 0194
Detects file transfers or mounting operations from remote hosts followed by write actions into a local staging directory, often using SMB or remote shell activity.
AN0195 Analytic 0195
Detects inbound SCP, rsync, or NFS mounts from remote systems followed by aggregation of files into known staging paths like /mnt/staging or /var/tmp.
AN0196 Analytic 0196
Detects rsync or scp inbound from other hosts that then aggregate content into /Users/Shared or /private/tmp, often involving compressed files or scripts.
AN0197 Analytic 0197
Detects remote writes or snapshots mounted from other systems into a central ESXi VMFS path or NFS store used for remote staging of files before exfiltration.
AN0198 Analytic 0198
Detects remote write activity across cloud VMs or object storage buckets within the same region/account that correlate with data aggregation across hosts.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1074.002 simulation workspace
- Cloud Storage Access · DC0025
- Command Execution · DC0064
- File Access · DC0055
- File Creation · DC0039
- Network Share Access · DC0102
- Network Traffic Content · DC0085
- Process Creation · DC0032
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.