Archiving utility writing an archive into a local staging directory

Siemphony@siemphonymediumT1074.001unverified

Matches an archive file created by a command-line archiving binary underneath a local directory that is world-writable or routinely used as scratch space, which is the write half of MITRE's AN0724. The analytic describes reads across many locations followed by a compressed write into a staging directory; the read side and the time correlation are a multi-event problem Sigma cannot express, so this rule keeps what survives in a single Sysmon EventID 11 record — who wrote, what was written, and where. All three gates are required together on purpose: without the extension gate the same archivers match every file they unpack, and unpacking a download or an installer payload is far more common on an endpoint than creating an archive. It is shaped on the file write rather than the command line because the invocation side of the same behaviour belongs to Archive Collected Data. The parent T1074 rule in this corpus covers the same file_event category keyed on extension and path alone, and its path list is drive-agnostic, so an archiver-produced archive in one of these folders alerts under both IDs until that rule is re-scoped to the remote and mapped-drive targets that separate .001 from .002; the local observable — the C: anchor plus the writing process — is owned here. MITRE's StagingDirList knob names C:\Temp and C:\Windows\Tasks; the other paths are authored, as are all of the binaries except 7z.exe and rar.exe, which MITRE's ArchivingToolPatterns knob names. That knob also names zip.exe, which is not a Windows binary and would never appear in Image, so it is dropped rather than carried over; diantz.exe is added here as the cabinet maker an operator would reach for, while makecab.exe is deliberately absent because Component-Based Servicing compresses its own logs with it on every update. `\AppData\Local\Temp\` is left out for the same reason the parent rule leaves it out — every installer and browser download writes an archive there, and including it would bury the signal in routine software activity rather than surface it; that is a real coverage gap and the first place to look when this rule is quiet. Two further blind spots: the paths are anchored on C: and will not match a system installed on another drive, and PowerShell Compress-Archive records Image as powershell.exe, which is far too noisy to include. Note the audit prerequisite — this category is fed either by Sysmon EventID 11, whose FileCreate rules in the common shipped configurations filter C:\Windows\Temp and C:\ProgramData out, or by Security 4663, which needs the *Audit File System* subcategory **and** a SACL on each of these folders. Neither is on in a default install, and neither is in the MS or CIS baselines, so an empty result here means nothing is being recorded. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0261, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (((InitiatingProcessFolderPath endswith "\\7z.exe" or InitiatingProcessFolderPath endswith "\\7za.exe" or InitiatingProcessFolderPath endswith "\\7zr.exe" or InitiatingProcessFolderPath endswith "\\7zg.exe" or InitiatingProcessFolderPath endswith "\\7zfm.exe" or InitiatingProcessFolderPath endswith "\\rar.exe" or InitiatingProcessFolderPath endswith "\\winrar.exe" or InitiatingProcessFolderPath endswith "\\tar.exe" or InitiatingProcessFolderPath endswith "\\diantz.exe") and (FolderPath endswith ".7z" or FolderPath endswith ".rar" or FolderPath endswith ".zip" or FolderPath endswith ".cab" or FolderPath endswith ".tar" or FolderPath endswith ".gz" or FolderPath endswith ".tgz")) and (FolderPath startswith "C:\\Temp\\" or FolderPath startswith "C:\\Windows\\Temp\\" or FolderPath startswith "C:\\Windows\\Tasks\\" or FolderPath startswith "C:\\PerfLogs\\" or FolderPath startswith "C:\\Users\\Public\\" or FolderPath startswith "C:\\ProgramData\\"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zr.exe" OR Image="*\\7zg.exe" OR Image="*\\7zfm.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe" OR Image="*\\tar.exe" OR Image="*\\diantz.exe") AND (TargetFilename="*.7z" OR TargetFilename="*.rar" OR TargetFilename="*.zip" OR TargetFilename="*.cab" OR TargetFilename="*.tar" OR TargetFilename="*.gz" OR TargetFilename="*.tgz")) AND (TargetFilename="C:\\Temp\\*" OR TargetFilename="C:\\Windows\\Temp\\*" OR TargetFilename="C:\\Windows\\Tasks\\*" OR TargetFilename="C:\\PerfLogs\\*" OR TargetFilename="C:\\Users\\Public\\*" OR TargetFilename="C:\\ProgramData\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\7z.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7za.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7zr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7zg.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7zfm.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winrar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\diantz.exe") AND (TO_LOWER(file.path) LIKE "*.7z" OR TO_LOWER(file.path) LIKE "*.rar" OR TO_LOWER(file.path) LIKE "*.zip" OR TO_LOWER(file.path) LIKE "*.cab" OR TO_LOWER(file.path) LIKE "*.tar" OR TO_LOWER(file.path) LIKE "*.gz" OR TO_LOWER(file.path) LIKE "*.tgz")) AND (TO_LOWER(file.path) LIKE "c:\\\\temp\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\windows\\\\temp\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\windows\\\\tasks\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\perflogs\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\users\\\\public\\\\*" OR TO_LOWER(file.path) LIKE "c:\\\\programdata\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\7z\.exe$|\\7za\.exe$|\\7zr\.exe$|\\7zg\.exe$|\\7zfm\.exe$|\\rar\.exe$|\\winrar\.exe$|\\tar\.exe$|\\diantz\.exe$)</field>    <field name="TargetFilename" type="pcre2">(?i)(\.7z$|\.rar$|\.zip$|\.cab$|\.tar$|\.gz$|\.tgz$)</field>    <field name="TargetFilename" type="pcre2">(?i)(^C:\\Temp\\|^C:\\Windows\\Temp\\|^C:\\Windows\\Tasks\\|^C:\\PerfLogs\\|^C:\\Users\\Public\\|^C:\\ProgramData\\)</field>    <description>Archiving utility writing an archive into a local staging directory</description>    <mitre>      <id>T1074.001</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 0a4f277e-b0b8-4a5e-8ba5-0709156c55d5

ATT&CKT1074.001

T1074.001Local Data Staging

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfil

01 · What this rule detects

Collection before departure: files gathered from profiles and shares, compressed — often into a password-protected archive — dropped into a staging directory, and then moved out of the environment. The staging half is the reliably detectable half, and it usually happens close enough to the transfer that catching it still leaves time to act.

02 · Telemetry you need

Process creation with full command lines for archiving utilities — 7z, rar, WinRAR's console build, tar.exe, makecab, and PowerShell Compress-Archive; the switches are the interesting part, so a truncated command line is worthless here
Sysmon EventID 11 (FileCreate) for archive extensions written under Temp, ProgramData, Public and the recycle bin
Sysmon EventID 3 (NetworkConnect) with DestinationIp, DestinationHostname, DestinationPort and Initiated, tied to the uploading process
Proxy, firewall or flow logs with bytes sent per session — these are the only records that carry volume and direction, and neither Sysmon nor the Security log has them
Security 5145 (detailed file share access) and 4663 (object access) for reads across shares — 5145 requires Audit Detailed File Share, 4663 requires Audit Object Access plus a SACL on the data itself, and all of it is off by default
DNS query logs, for the cloud storage and tunnelling destinations the transfer half resolves

03 · How the logic works

Split this into two rules, because it is really two behaviours with different telemetry. The staging rule is a process rule: an archiving utility invoked with a recursion switch, an output path under a staging directory, or a password flag, over a source path that holds user data or share content. Anchor on the switches and the paths rather than the tool name — a renamed rar.exe still needs the same arguments to do the same job — and keep the password flag as its own higher-severity condition, since ordinary backup rarely needs one. The transfer rule is a volume and destination rule, and it does not express well in Sigma: there is no aggregation, so the bytes-sent threshold and the per-destination grouping live in the backend query or the correlation layer. The pairing that makes both worth having is sequence — an archive created, then that same file opened by a process that immediately connects outbound.

04 · Common false positives

Backup and archiving agents doing precisely this by design, including Veeam, Acronis and Windows Server Backup
Sanctioned cloud sync clients — OneDrive, Dropbox, Box — moving large volumes to destinations that are supposed to receive them
Developers and build agents compressing source trees, artefacts and logs, and CI runners uploading them
IT collecting diagnostic bundles and log archives for a vendor support case
E-discovery, DLP and data-classification scanners reading broadly across shares, and migration tooling moving mailboxes or file servers

05 · Detection maturity

Tier 1 — starting point: Matches archiving utility command lines by tool name.
Tier 2 — tuned: Matches recursion and password switches over sensitive source paths, with backup and sync clients excluded by signed path.
Tier 3 — correlated: Correlates archive creation with the subsequent read and outbound transfer of that file, scored on destination novelty and volume.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Password-protected archives of user data are the highest-payoff single condition in this category; alert on those before anything else
Scope the staging rule by source path — profile directories and file shares — rather than by the utility, so unfamiliar tools still match
Exclude sanctioned cloud sync by the signed path of the client process, not by destination domain, or you excuse anything that can reach the same domain
Keep staging and transfer as separate alerts so each stays actionable, and correlate them for severity rather than merging them into one rule
Where the archive is written matters more than what wrote it: a user-writable staging directory holding an archive of someone else's data is the shape you are looking for

Declared by the author

Backup, log-shipping and vendor support agents that call 7z.exe or tar.exe to package diagnostics into ProgramData or the Windows Temp directory before uploading them. On a managed fleet this is the top talker and it is why the level is not higher; it is indistinguishable from staging at the event level and needs an allowlist keyed on the parent process or the service account.
Archive extraction where the contents are themselves archives — 7z.exe, 7zfm.exe, winrar.exe or tar.exe unpacking a vendor bundle or a downloaded package into ProgramData or the Windows Temp directory and writing the .zip, .cab or .gz members it contains. This is decompression rather than staging and it is the population the extension gate narrows but does not remove.
A user compressing files into the Public user directory through the 7-Zip file manager to hand them to another local account on the same machine. This is ordinary desktop behaviour and is why 7zfm.exe carries more noise than the other entries in the list.
Developer, CI and Windows setup tooling using the bsdtar-derived tar.exe that ships in System32 to build or repack a .tar or .gz under C:\Windows\Temp or C:\Temp during a build or an in-place upgrade.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1074.001, evaluated against their file_event events.

Share this rule

/u/siemphony/0a4f277e-b0b8-4a5e-8ba5-0709156c55d5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Archiving utility writing an archive into a local staging directory

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it