T1074 Data Staged
Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdletmediumtest · windows
- Google Full Network Traffic Packet Capturemediumtest · gcp
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Modulemediumtest · windows
- Zip A Folder With PowerShell For Staging In Temp - PowerShellmediumtest · windows
- Zip A Folder With PowerShell For Staging In Temp - PowerShell Scriptmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.