Archive written to a shared or world-writable staging directory

Siemphony@siemphonymediumT1074unverified

Detects an archive file appearing in one of the directories an operator reaches for when consolidating collected data before exfiltration. AN0040 describes two things — the compression step and the staging location — and this rule takes the location, because that is what separates Data Staged from ordinary archiving: the same 7-Zip invocation is unremarkable in a user's documents folder and is the technique when the output lands somewhere every account on the host can read. The path list is MITRE's StagingDirectoryList knob populated here with the shared and machine-scope directories, and it deliberately omits `\AppData\Local\Temp\`: every installer and browser download extracts an archive there, and including it would bury the signal in routine software activity rather than surface it. Because the match is on the written file and not on the writing process, an archive produced by a hand-rolled tool with no recognisable name still matches, while a staged folder of loose uncompressed files does not. Note the audit prerequisite — this category is fed either by Sysmon EventID 11, whose FileCreate rules in the common shipped configurations filter these paths out, or by Security 4663, which needs the *Audit File System* subcategory **and** a SACL on each of these folders. Neither is on in a default install, and neither is in the MS or CIS baselines, so an empty result here means nothing is being recorded. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0014, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where ((FolderPath contains "\\Users\\Public\\" or FolderPath contains "\\ProgramData\\" or FolderPath contains "\\Windows\\Temp\\" or FolderPath contains "\\PerfLogs\\" or FolderPath contains "\\$Recycle.Bin\\" or FolderPath contains "\\Windows\\Tasks\\") and (FolderPath endswith ".7z" or FolderPath endswith ".rar" or FolderPath endswith ".zip" or FolderPath endswith ".cab" or FolderPath endswith ".tar" or FolderPath endswith ".gz" or FolderPath endswith ".tgz" or FolderPath endswith ".iso"))

Splunk · SPL

Run this as a search.

index=* ((TargetFilename="*\\Users\\Public\\*" OR TargetFilename="*\\ProgramData\\*" OR TargetFilename="*\\Windows\\Temp\\*" OR TargetFilename="*\\PerfLogs\\*" OR TargetFilename="*\\$Recycle.Bin\\*" OR TargetFilename="*\\Windows\\Tasks\\*") AND (TargetFilename="*.7z" OR TargetFilename="*.rar" OR TargetFilename="*.zip" OR TargetFilename="*.cab" OR TargetFilename="*.tar" OR TargetFilename="*.gz" OR TargetFilename="*.tgz" OR TargetFilename="*.iso"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*\\\\users\\\\public\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\temp\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\perflogs\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\$recycle.bin\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\tasks\\\\*") AND (TO_LOWER(file.path) LIKE "*.7z" OR TO_LOWER(file.path) LIKE "*.rar" OR TO_LOWER(file.path) LIKE "*.zip" OR TO_LOWER(file.path) LIKE "*.cab" OR TO_LOWER(file.path) LIKE "*.tar" OR TO_LOWER(file.path) LIKE "*.gz" OR TO_LOWER(file.path) LIKE "*.tgz" OR TO_LOWER(file.path) LIKE "*.iso"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\\Users\\Public\\|\\ProgramData\\|\\Windows\\Temp\\|\\PerfLogs\\|\\\$Recycle\.Bin\\|\\Windows\\Tasks\\)</field>    <field name="TargetFilename" type="pcre2">(?i)(\.7z$|\.rar$|\.zip$|\.cab$|\.tar$|\.gz$|\.tgz$|\.iso$)</field>    <description>Archive written to a shared or world-writable staging directory</description>    <mitre>      <id>T1074</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: bb06ea25-58cd-49c6-a15e-2d03a5fcbcc1

ATT&CKT1074

T1074Data Staged

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

An archive file appearing in one of the shared or machine-scope directories an operator reaches for when consolidating collected data before exfiltration. MITRE's AN0040 describes two things: compression, and the staging location. The author took the location, on a good argument — a 7z a in a user's documents folder is unremarkable, and the same invocation writing where every account on the host can read is the technique. Matching the written file rather than the writing process also means a hand-rolled archiver with no recognisable name still matches. The coverage cost deserves saying louder than the description does. T1074 is staging, and copying a folder of loose uncompressed files into C:\Users\Public\ is the canonical form of this technique — it produces nothing here. The rule detects the intersection of T1074 and T1560.001, and of that pair only the location half is technique-specific.

02 · Telemetry you need

Sysmon EventID 11, and only Sysmon EventID 11.
The description offers a choice — "either by Sysmon EventID 11 ... or by Security 4663, which needs the Audit File System subcategory and a SACL on each of these folders" — and that choice does not exist. TargetFilename is a Sysmon field; Security 4663 carries ObjectName and ProcessName and has no TargetFilename at all. A reader who follows that sentence configures SACLs on six directories to feed a rule that returns zero rows no matter how much staging happens.
The brief maps 4663 onto the Sysmon-shaped file_event category, and picking the Sysmon vocabulary is correct. Presenting the two feeds as interchangeable is not. Name the vocabulary the rule speaks, and say the other feed needs a field mapping first. A misstated prerequisite is worse than a missing one — it sends someone to do real work for no result. The Sysmon caveat is real too: common shipped FileCreate configurations filter these very paths out.

03 · How the logic works

Two selections, ANDed, both on TargetFilename:

The path list is MITRE's StagingDirectoryList knob populated by the author, and the description attributes it that way. Omitting \AppData\Local\Temp\ is reasoned rather than assumed: every installer and browser extracts an archive there, so including it would bury the signal. Now look at '\$Recycle.Bin\'. When any user deletes any file, Windows does not erase it — it moves it to C:\$Recycle.Bin\<SID>\$R......zip, keeping the original extension, and Sysmon records that move as a file create. So every time anybody on the estate deletes a .zip, this rule fires with both selections satisfied. That one term turns the delete key into a detection. And the falsepositives block — otherwise strong, covering ProgramData, Windows\Temp, servicing .cab files and Users\Public — never mentions deletion once. *The lesson: read every entry in a path list as a question about who writes there, not who stages there.* $Recycle.Bin looks like a hiding place, and adversaries do occasionally use it — but its overwhelming population is ordinary deletions, and a term whose benign volume is measured in deletes-per-user-per-day cannot sit in a selection unqualified. Drop it, or make it the first false positive and say plainly that a hit there means an archive was deleted, not staged. The archive half is extension-only, too. 7z a C:\Users\Public\update.dat stages a real 7-Zip archive in a listed directory and matches nothing.

04 · Common false positives

Users deleting archives. Every workstation, all day, unlisted.
Software distribution, patching and endpoint agents staging compressed
Windows servicing writing .cab files into Windows\Temp, bursting across
Backup and diagnostic collectors archiving a directory into a shared location,
Users treating Users\Public as the file-sharing folder it is designed to be.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0014 and never executed against a single log line.
tier_2: confirm your Sysmon FileCreate config does not exclude these paths, run it over history, and see how much of the volume is the recycle bin.
tier_3: needs the burst count and the uncompressed-staging case, neither reachable by a single-event rule.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Remove or qualify \$Recycle.Bin\. Suppress agent traffic by writing process or vendor subfolder rather than by removing \ProgramData\, which would take the technique's most-used location with it. Pair this with the T1560.001 process-creation rule so a hit is triageable from either side.
MITRE's TimeWindow knob is aimed at the batch shape of real staging — many files in quick succession — and that burst quality is what to key on rather than any single write. Sigma cannot count, so it happens in your correlation layer or in the analyst's head.
level: medium is well argued here, against a named top talker. Copy that calibration pattern.

Declared by the author

Software distribution, patching and endpoint agents, which stage compressed payloads under ProgramData and the Windows Temp folder on every managed host. This is the rule's top talker fleet-wide and it is the reason the level is not higher; suppress by the writing process or by the vendor's own subfolder rather than by removing ProgramData, which would take the technique's most-used location with it.
Windows servicing itself, which writes .cab files into the Windows Temp folder during update installation and component repair, producing bursts on patch day across the whole estate.
Backup, log-collection and vendor diagnostic collectors that archive a directory into a shared location before uploading it — the same write, the same extension and often the same tool an operator would use, separated only by the account and the schedule behind it.
Users treating the Public user folder as the intended file-sharing location on a shared workstation, which is what that folder is for. MITRE's TimeWindow knob is aimed at the batch shape of real staging, many files in quick succession, and that burst quality is the thing to key on rather than any single write.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1074, evaluated against their file_event events.

Share this rule

/u/siemphony/bb06ea25-58cd-49c6-a15e-2d03a5fcbcc1

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Archive written to a shared or world-writable staging directory

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it