T1074 — Data Staged

# T1074 - Data Staged

## SOC Recommendation
Investigate Data Staged activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| System Call Analysis | Detect | Monitor for System Call Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| System Call Filtering | Isolate | Apply System Call Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Contain the affected host or account | Medium | No | Yes |
| Collect and preserve evidence | Low | Yes | No |

## KQL
```kql
let StagingPaths = dynamic(["Temp", "Downloads", "Desktop", "AppData", "ProgramData", "Public", "Recycle"]);
let ArchiveExtensions = dynamic([".zip", ".7z", ".rar", ".tar", ".gz", ".tar.gz", ".tgz", ".cab"]);
DeviceFileEvents
| where TimeGenerated >= ago(30m)
| where ActionType == "FileCreated"
| where FileName has_any (ArchiveExtensions)
| where FolderPath has_any (StagingPaths)
| summarize
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    ArchiveCount = count(),
    Archives = make_set(FileName, 20)
    by DeviceName, AccountName, InitiatingProcessFileName
| extend timestamp = StartTime,
         HostCustomEntity = DeviceName,
         AccountCustomEntity = AccountName
| order by ArchiveCount desc
```
```kql
let highVolumeThresholdGB = 1;
NetskopeWebTransactions_CL
| where TimeGenerated > ago(1h)
| where isnotempty(CsUsername)
| summarize 
    TotalBytes = sum(Bytes),
    UploadBytes = sum(CsBytes),
    DownloadBytes = sum(ScBytes),
    UniqueApps = dcount(XCsApp),
    Apps = make_set(XCsApp, 20),
    UniqueHosts = dcount(CsHost),
    Activities = make_set(XCsAppActivity),
    Countries = make_set(XCCountry),
    Devices = make_set(XCDevice),
    AccessMethods = make_set(XCsAccessMethod),
    EventCount = count()
    by CsUsername, XCDevice, XCsAccessMethod
| extend 
    TotalGB = round(TotalBytes / 1073741824.0, 3),
    UploadGB = round(UploadBytes / 1073741824.0, 3),
    DownloadGB = round(DownloadBytes / 1073741824.0, 3)
| where TotalGB > highVolumeThresholdGB
| extend IsUnmanagedDevice = XCDevice =~ 'unmanaged' or XCDevice =~ 'BYOD' or XCDevice =~ 'Personal' or XCDevice =~ 'Unknown' or XCsAccessMethod != 'Client'
| where IsUnmanagedDevice or TotalGB > 5 or UniqueApps > 20
| extend RiskIndicators = strcat_array(array_concat(
    iff(IsUnmanagedDevice, dynamic(['Unmanaged Device']), dynamic([])),
    iff(TotalGB > 5, dynamic(['High Data Volume']), dynamic([])),
    iff(UniqueApps > 20, dynamic(['Many Apps Accessed']), dynamic([])),
    iff(array_length(Countries) > 1, dynamic(['Multiple Countries']), dynamic([]))
), ', ')
| project 
    TimeGenerated = now(),
    User = CsUsername,
    Device = XCDevice,
    AccessMethod = XCsAccessMethod,
    TotalDataGB = TotalGB,
    UploadGB,
    DownloadGB,
    UniqueApplications = UniqueApps,
    Applications = Apps,
    UniqueHosts,
    Activities,
    Countries,
    EventCount,
    IsUnmanagedDevice,
    RiskIndicators
```
```kql
let lookbackPeriod = 7d;
let currentPeriod = 1h;
let threshold = 3;
let baseline = NetskopeWebTransactions_CL
    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))
    | where isnotempty(CsUsername)
    | where XCsAppActivity =~ 'Download' or ScBytes > 0
    | summarize 
        BaselineAvgBytes = avg(ScBytes),
        BaselineTotalBytes = sum(ScBytes),
        BaselineCount = count()
        by CsUsername
    | extend BaselineDailyAvg = BaselineTotalBytes / 7;
let current = NetskopeWebTransactions_CL
    | where TimeGenerated > ago(currentPeriod)
    | where isnotempty(CsUsername)
    | where XCsAppActivity =~ 'Download' or ScBytes > 0
    | summarize 
        CurrentTotalBytes = sum(ScBytes),
        CurrentCount = count(),
        Apps = make_set(XCsApp),
        Files = make_set(XCsAppObjectName)
        by CsUsername;
current
| join kind=inner baseline on CsUsername
| where CurrentTotalBytes > (BaselineDailyAvg * threshold)
| extend 
    SpikeMultiplier = round(CurrentTotalBytes / BaselineDailyAvg, 2),
    CurrentTotalMB = round(CurrentTotalBytes / 1048576.0, 2),
    BaselineDailyMB = round(BaselineDailyAvg / 1048576.0, 2)
| project 
    TimeGenerated = now(),
    User = CsUsername,
    CurrentDownloadMB = CurrentTotalMB,
    BaselineDailyAvgMB = BaselineDailyMB,
    SpikeMultiplier,
    DownloadCount = CurrentCount,
    ApplicationsUsed = Apps,
    FilesDownloaded = Files
```

## Escalation Criteria
- Data Staged activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1074.json
• /api/recommendations/T1074.json
• /api/d3fend/T1074.json
• /api/mappings/T1074.json
• /api/confluence/T1074.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1074.json

Response:

{
  "technique_id": "T1074",
  "name": "Data Staged",
  "priority": "high",
  "status": "draft",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Collection"
  ],
  "platforms": [
    "ESXi",
    "IaaS",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location...",
  "soc_recommendation": "Investigate Data Staged activity in the context of Collection: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-SCA",
      "name": "System Call Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for System Call Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-SCF",
      "name": "System Call Filtering",
      "relationship": "isolate",
      "practical_action": "Apply System Call Filtering to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed data staged activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"Data Staged for Exfiltration\" -- Flags large archive files created in user-writable staging locations, commonly the step immediately before exfiltration."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Contain the affected host or account",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Defender for Endpoint / Entra ID",
      "notes": "Requires approval -- confirm malicious intent before isolating a host or disabling an account."
    },
    {
      "name": "Collect and preserve evidence",
      "category": "Investigation",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Defender for Endpoint",
      "notes": "Safe -- read-only evidence collection."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "GEN-CO-005 — Data Staged for Exfiltration",
        "description": "Flags large archive files created in user-writable staging locations, commonly the step immediately before exfiltration. (Source: Bell Integration baseline detection library.)",
        "query": "let StagingPaths = dynamic([\"Temp\", \"Downloads\", \"Desktop\", \"AppData\", \"ProgramData\", \"Public\", \"Recycle\"]);\nlet ArchiveExtensions = dynamic([\".zip\", \".7z\", \".rar\", \".tar\", \".gz\", \".tar.gz\", \".tgz\", \".cab\"]);\nDeviceFileEvents\n| where TimeGenerated >= ago(30m)\n| where ActionType == \"FileCreated\"\n| where FileName has_any (ArchiveExtensions)\n| where FolderPath has_any (StagingPaths)\n| summarize\n    StartTime = min(TimeGenerated),\n    EndTime = max(TimeGenerated),\n    ArchiveCount = count(),\n    Archives = make_set(FileName, 20)\n    by DeviceName, AccountName, InitiatingProcessFileName\n| extend timestamp = StartTime,\n         HostCustomEntity = DeviceName,\n         AccountCustomEntity = AccountName\n| order by ArchiveCount desc"
      },
      {
        "name": "fa4c4f1c-3c5f-4c3a-a13f-924c30db56e9 — Netskope - Anomalous User Behavior (High Volume from Unmanaged Device)",
        "description": "Detects anomalous user behavior including high data volume transfers from unmanaged devices, unusual access patterns, and suspicious application usage. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let highVolumeThresholdGB = 1;\nNetskopeWebTransactions_CL\n| where TimeGenerated > ago(1h)\n| where isnotempty(CsUsername)\n| summarize \n    TotalBytes = sum(Bytes),\n    UploadBytes = sum(CsBytes),\n    DownloadBytes = sum(ScBytes),\n    UniqueApps = dcount(XCsApp),\n    Apps = make_set(XCsApp, 20),\n    UniqueHosts = dcount(CsHost),\n    Activities = make_set(XCsAppActivity),\n    Countries = make_set(XCCountry),\n    Devices = make_set(XCDevice),\n    AccessMethods = make_set(XCsAccessMethod),\n    EventCount = count()\n    by CsUsername, XCDevice, XCsAccessMethod\n| extend \n    TotalGB = round(TotalBytes / 1073741824.0, 3),\n    UploadGB = round(UploadBytes / 1073741824.0, 3),\n    DownloadGB = round(DownloadBytes / 1073741824.0, 3)\n| where TotalGB > highVolumeThresholdGB\n| extend IsUnmanagedDevice = XCDevice =~ 'unmanaged' or XCDevice =~ 'BYOD' or XCDevice =~ 'Personal' or XCDevice =~ 'Unknown' or XCsAccessMethod != 'Client'\n| where IsUnmanagedDevice or TotalGB > 5 or UniqueApps > 20\n| extend RiskIndicators = strcat_array(array_concat(\n    iff(IsUnmanagedDevice, dynamic(['Unmanaged Device']), dynamic([])),\n    iff(TotalGB > 5, dynamic(['High Data Volume']), dynamic([])),\n    iff(UniqueApps > 20, dynamic(['Many Apps Accessed']), dynamic([])),\n    iff(array_length(Countries) > 1, dynamic(['Multiple Countries']), dynamic([]))\n), ', ')\n| project \n    TimeGenerated = now(),\n    User = CsUsername,\n    Device = XCDevice,\n    AccessMethod = XCsAccessMethod,\n    TotalDataGB = TotalGB,\n    UploadGB,\n    DownloadGB,\n    UniqueApplications = UniqueApps,\n    Applications = Apps,\n    UniqueHosts,\n    Activities,\n    Countries,\n    EventCount,\n    IsUnmanagedDevice,\n    RiskIndicators"
      },
      {
        "name": "dd0ebd84-ffbe-45df-848b-0615ac446b04 — Netskope - Excessive Downloads Detection (Spike vs Baseline)",
        "description": "Detects users with excessive download activity compared to their 7-day baseline. Triggers when current download volume exceeds 3x the average. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let lookbackPeriod = 7d;\nlet currentPeriod = 1h;\nlet threshold = 3;\nlet baseline = NetskopeWebTransactions_CL\n    | where TimeGenerated between (ago(lookbackPeriod) .. ago(currentPeriod))\n    | where isnotempty(CsUsername)\n    | where XCsAppActivity =~ 'Download' or ScBytes > 0\n    | summarize \n        BaselineAvgBytes = avg(ScBytes),\n        BaselineTotalBytes = sum(ScBytes),\n        BaselineCount = count()\n        by CsUsername\n    | extend BaselineDailyAvg = BaselineTotalBytes / 7;\nlet current = NetskopeWebTransactions_CL\n    | where TimeGenerated > ago(currentPeriod)\n    | where isnotempty(CsUsername)\n    | where XCsAppActivity =~ 'Download' or ScBytes > 0\n    | summarize \n        CurrentTotalBytes = sum(ScBytes),\n        CurrentCount = count(),\n        Apps = make_set(XCsApp),\n        Files = make_set(XCsAppObjectName)\n        by CsUsername;\ncurrent\n| join kind=inner baseline on CsUsername\n| where CurrentTotalBytes > (BaselineDailyAvg * threshold)\n| extend \n    SpikeMultiplier = round(CurrentTotalBytes / BaselineDailyAvg, 2),\n    CurrentTotalMB = round(CurrentTotalBytes / 1048576.0, 2),\n    BaselineDailyMB = round(BaselineDailyAvg / 1048576.0, 2)\n| project \n    TimeGenerated = now(),\n    User = CsUsername,\n    CurrentDownloadMB = CurrentTotalMB,\n    BaselineDailyAvgMB = BaselineDailyMB,\n    SpikeMultiplier,\n    DownloadCount = CurrentCount,\n    ApplicationsUsed = Apps,\n    FilesDownloaded = Files"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "a0fbd7a9-1923-4e05-92df-b484168f17bc — Sensitive File Access followed by Compression",
        "description": "(EQL) Detects when a sensitive file is accessed followed by the immediate creation of a compressed file in a suspicious location. This activity can indicate an attempt to collect sensitive local data and stage it for exfiltration. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by process.entity_id with maxspan=30s\n  [file where host.os.type == \"macos\" and event.action == \"open\" and \n    not file.name in~ (\"System.keychain\", \"login.keychain-db\", \"preferences.plist\", \"com.apple.TimeMachine.plist\")]\n  [file where host.os.type == \"macos\" and event.action == \"modification\" and \n    file.extension in (\"zip\", \"gzip\", \"gz\") and\n    file.path like~ (\"/Users/Shared/*\", \"/Library/WebServer/*\", \"/Users/*/Library/WebServer/*\",\n                     \"/Library/Graphics/*\", \"/Users/*/Library/Graphics/*\", \"/Library/Fonts/*\",\n                     \"/Users/*/Library/Fonts/*\", \"/private/var/root/Library/HTTPStorages/*\",\n                     \"/tmp/*\", \"/var/tmp/*\", \"/private/tmp/*\") and\n    not file.path like~ (\"/Library/Logs/CrashReporter/*\", \"/private/tmp/publish.*\")]"
      },
      {
        "name": "60da1bd7-c0b9-4ba2-b487-50a672274c04 — Discovery Command Output Written to Suspicious File",
        "description": "(EQL) Detects when a discovery command is executed followed by the immediate modification of a suspicious file via the same process. Many types of malware execute discovery commands, save the output to a file, and then exfiltrate that file via their C2 channel. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by process.entity_id with maxspan=15s\n  [process where host.os.type == \"macos\" and event.type == \"start\" and event.action == \"exec\" and\n    process.parent.name in (\"bash\", \"sh\", \"zsh\") and\n    process.name in (\"whoami\", \"ifconfig\", \"system_profiler\", \"dscl\", \"arch\", \"csrutil\") and\n    process.args_count == 1]\n  [file where host.os.type == \"macos\" and event.action == \"modification\" and\n    file.path like (\"/Users/Shared/*\", \"/tmp/*\", \"/private/tmp/*\", \"/Library/WebServer/*\",\n                    \"/Library/Graphics/*\", \"/Library/Fonts/*\", \"/private/var/root/Library/HTTPStorages/*\", \"/*/.*\") and\n    not file.path like (\"/private/tmp/*.fifo\", \"/private/tmp/tcl-tk*\")]"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Data Staged activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1074 - Data Staged Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}