Archive written to a shared or world-writable staging directory

1title: Archive written to a shared or world-writable staging directory2id: bb06ea25-58cd-49c6-a15e-2d03a5fcbcc13status: experimental4description: |5  Detects an archive file appearing in one of the directories an operator6  reaches for when consolidating collected data before exfiltration. AN00407  describes two things — the compression step and the staging location — and8  this rule takes the location, because that is what separates Data Staged from9  ordinary archiving: the same 7-Zip invocation is unremarkable in a user's10  documents folder and is the technique when the output lands somewhere every11  account on the host can read. The path list is MITRE's StagingDirectoryList12  knob populated here with the shared and machine-scope directories, and it13  deliberately omits `\AppData\Local\Temp\`: every installer and browser14  download extracts an archive there, and including it would bury the signal in15  routine software activity rather than surface it. Because the match is on the16  written file and not on the writing process, an archive produced by a17  hand-rolled tool with no recognisable name still matches, while a staged18  folder of loose uncompressed files does not. Note the audit prerequisite —19  this category is fed either by Sysmon EventID 11, whose FileCreate rules in20  the common shipped configurations filter these paths out, or by Security 4663,21  which needs the *Audit File System* subcategory **and** a SACL on each of22  these folders. Neither is on in a default install, and neither is in the23  MS or CIS baselines, so an empty result here means nothing is being recorded.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0014, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T107427  - https://attack.mitre.org/detectionstrategies/DET001428author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.collection32  - attack.t107433logsource:34  category: file_event35  product: windows36detection:37  selection_staging_path:38    TargetFilename|contains:39      - '\Users\Public\'40      - '\ProgramData\'41      - '\Windows\Temp\'42      - '\PerfLogs\'43      - '\$Recycle.Bin\'44      - '\Windows\Tasks\'45  selection_archive_extension:46    TargetFilename|endswith:47      - '.7z'48      - '.rar'49      - '.zip'50      - '.cab'51      - '.tar'52      - '.gz'53      - '.tgz'54      - '.iso'55  condition: selection_staging_path and selection_archive_extension56falsepositives:57  - "Software distribution, patching and endpoint agents, which stage compressed payloads under ProgramData and the Windows Temp folder on every managed host. This is the rule's top talker fleet-wide and it is the reason the level is not higher; suppress by the writing process or by the vendor's own subfolder rather than by removing ProgramData, which would take the technique's most-used location with it."58  - "Windows servicing itself, which writes .cab files into the Windows Temp folder during update installation and component repair, producing bursts on patch day across the whole estate."59  - "Backup, log-collection and vendor diagnostic collectors that archive a directory into a shared location before uploading it — the same write, the same extension and often the same tool an operator would use, separated only by the account and the schedule behind it."60  - "Users treating the Public user folder as the intended file-sharing location on a shared workstation, which is what that folder is for. MITRE's TimeWindow knob is aimed at the batch shape of real staging, many files in quick succession, and that burst quality is the thing to key on rather than any single write."61level: medium