Skip to content
Sign In
Learn

T1074.001

Local Data Staging

What it is

Attackers gather the files they want into one place on a host before taking them out. It is a sub-technique of Data Staged, under the Collection tactic. Staging is the step between finding data and stealing it, so a new folder filling with copied files can be the last warning before data leaves.

How adversaries use it

After finding useful files, the attacker copies them from user folders and file shares into one folder, often somewhere unremarkable or newly created, using built-in copy commands or robocopy. Many then compress the folder into an archive, which is smaller, quicker to move and hides the file names, and take it out in one transfer.

Detect it in Elastic

Data source: Windows process creation and file creation events (Sysmon)

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) when the copy command starts process.name: the copy tool, such as Robocopy.exe; check how your data spells it, since KQL matches case exactly process.command_line: the source and destination folders event.code: 11 (Sysmon) when a file is created file.path: the new file's full path, which shows the staging folder user.name: the account doing the copying host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-307.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "Robocopy.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "command_line": "robocopy E:\\Depot D:\\stg01 /S"
  },
  "@timestamp": "2026-06-02T14:38:52.019Z"
}

Prebuilt Elastic rule: File Staged in Root Folder of Recycle Bin

Hunt guidance

Start with bulk copies: process.name: ("Robocopy.exe" or "robocopy.exe" or "xcopy.exe" or "XCOPY.EXE"). Then look for many files created in one folder by one process within a few minutes: event.code: 11, grouped by host.name and the folder in file.path. Look for a new folder filling with documents from many sources, an archive appearing in that folder soon afterward, and staging on a host that later makes a large outbound transfer.

Ruling out legitimate activity

Backups, migrations, synchronization tools and users reorganizing their files all copy many files at once. Check whether the account and tool are part of a known job, whether the destination is a known backup location, and what happened to the folder next. A folder that is archived and then sent out of the network is the pattern that matters.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.