ATT&CK technique
View on MITRE ATT&CK →
T1074
Data Staged
Collection
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential OpenSSH Backdoor Logging Activity | production | 2026-10-08 |
| elastic | Google Workspace Drive Data Transfer or Takeout Export Initiated | production | 2026-09-18 |
| elastic | Sensitive File Access followed by Compression | production | 2026-09-18 |
| elastic | Exchange Mailbox Export via PowerShell | production | 2026-09-18 |
| elastic | Remote File Copy to a Hidden Share | production | 2026-09-18 |
| elastic | Data Encrypted via OpenSSL Utility | production | 2026-09-18 |
| elastic | AWS RDS DB Instance Restored | production | 2026-09-18 |
| elastic | AWS EC2 Full Network Packet Capture Detected | production | 2026-09-18 |
| elastic | Discovery Command Output Written to Suspicious File | production | 2026-09-18 |
| splunk | Suspicious SQLite3 LSQuarantine Behavior | experimental | 2026-05-13 |
| sigma | Cisco Stage Data | test | 2023-01-04 |
| sigma | Google Full Network Traffic Packet Capture | test | 2022-10-09 |