AN0724
Analytic 0724
Windows
Detects file reads across locations followed by writes to temp or staging directories, often compressed or encrypted, indicating local staging behavior.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Security
EventCode=4663, 4670, 4656
[StagingDirList]
Paths such as C:\Temp, C:\Windows\Tasks, etc.
[ArchivingToolPatterns]
Matches to 7z.exe, rar.exe, zip.exe, or custom scripts.
[TimeWindow]
How long to correlate file reads followed by compression.
AN0725
Analytic 0725
Linux
Detects aggregation of files from different directories into /tmp, /mnt, or user-specified directories with archiving tools like tar or gzip.
auditd:SYSCALL
open
auditd:SYSCALL
execve
[StagingDirs]
e.g., /tmp, /var/tmp, custom user dirs
[ArchiveUtilities]
tar, gzip, zip, 7z
[UserThreshold]
Number of files or size written in short time
AN0726
Analytic 0726
macOS
Detects staged data aggregated in /Users/Shared, /private/tmp with compression tools like ditto or zip, initiated via Terminal or AppleScript.
macos:unifiedlog
file events
macos:unifiedlog
exec logs
[StagingTargets]
Shared dirs commonly abused for local collection
[CompressionBinaries]
zip, tar, ditto
[TimeWindow]
Seconds/minutes between source file read and output staging write
AN0727
Analytic 0727
ESXi
Detects local staging behavior via snapshot creation or files written into VMFS partitions by scripts or unauthorized shell access.
esxi:vmkernel
snapshot create/write events
esxi:shell
CLI usage logs
[SnapshotThreshold]
Rapid creation or deletion of snapshots
[CLIInvoker]
Unexpected CLI/script invocation outside maintenance windows
[VMFSWriteRate]
Volume of data written locally in short time