<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-data-staging-for-exfiltration
description: >-
  Detect data staging activities where threat actors or insiders collect and
  aggregate sensitive data into staging locations prior to exfiltration, including
  local archive creation, temp directory accumulation, and cloud staging patterns.
domain: cybersecurity
subdomain: data-security
tags:
  - data-staging
  - exfiltration
  - mitre-t1074
  - archive-detection
  - insider-threat
  - lateral-movement
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1074"]
---

# Detecting Data Staging For Exfiltration

## Overview

Detect data staging activities where threat actors or insiders collect and
aggregate sensitive data into staging locations prior to exfiltration, including
local archive creation, temp directory accumulation, and cloud staging patterns.

Mode: `[MODE: BLUE]` — Detecting Data Staging For Exfiltration.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action detect --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action archives --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action scan --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action detect --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Detection

```yaml
title: Data Staging For Exfiltration Detection
id: 111e199a-8592-4d9b-b5a3-ef0317ed5f44
status: experimental
description: Detects suspicious activity related to detecting data staging for exfiltration techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1074
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Data Staging For Exfiltration Detection | windows/file_access | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1074 |

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
