ATT&CK technique
View on MITRE ATT&CK →
T1074.001
Local Data Staging
Collection
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential OpenSSH Backdoor Logging Activity | production | 2026-10-08 |
| elastic | Data Encrypted via OpenSSL Utility | production | 2026-09-18 |
| elastic | Discovery Command Output Written to Suspicious File | production | 2026-09-18 |
| elastic | Sensitive File Access followed by Compression | production | 2026-09-18 |
| elastic | Exchange Mailbox Export via PowerShell | production | 2026-09-18 |
| splunk | Shai-Hulud 2 Exfiltration Artifact Files | production | 2026-05-13 |
| sigma | Zip A Folder With PowerShell For Staging In Temp - PowerShell | test | 2023-12-18 |
| sigma | Zip A Folder With PowerShell For Staging In Temp - PowerShell Module | test | 2023-12-18 |
| sigma | Zip A Folder With PowerShell For Staging In Temp - PowerShell Script | test | 2023-12-18 |
| sigma | Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet | test | 2022-10-09 |