AN0194
Analytic 0194
Windows
Detects file transfers or mounting operations from remote hosts followed by write actions into a local staging directory, often using SMB or remote shell activity.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Microsoft-Windows-SMBClient/Security
EventCode=31001
WinEventLog:PowerShell
CommandLine=copy-item or robocopy from UNC path
[StagingDirectory]
Common directories such as C:\Temp, Downloads, or hidden folders used for remote staging
[RemotePathPatterns]
UNC paths like \\10.* or \\domain\share indicating lateral data staging
[CopyToolPatterns]
Usage of robocopy, xcopy, copy-item, or scheduled tasks performing cross-host copies
AN0195
Analytic 0195
Linux
Detects inbound SCP, rsync, or NFS mounts from remote systems followed by aggregation of files into known staging paths like /mnt/staging or /var/tmp.
auditd:SYSCALL
open
auditd:SYSCALL
execve
NSM:Flow
SSH logins or scp activity
[RemoteHosts]
Expected inbound transfer hosts to filter normal activity from staging behavior
[MountTargets]
Directory destinations used as centralized locations
[TransferVolumeThreshold]
Threshold of transferred files or data volume over time
AN0196
Analytic 0196
macOS
Detects rsync or scp inbound from other hosts that then aggregate content into /Users/Shared or /private/tmp, often involving compressed files or scripts.
macos:unifiedlog
exec logs
macos:unifiedlog
file events
NSM:Flow
remote login and transfer
[StagingPaths]
Monitored remote-to-local write destinations such as /Users/Shared
[CompressionIndicators]
Presence of .zip, .7z, or tar.gz indicating consolidation
[TimeWindow]
Temporal correlation of transfer and staging write operations
AN0197
Analytic 0197
ESXi
Detects remote writes or snapshots mounted from other systems into a central ESXi VMFS path or NFS store used for remote staging of files before exfiltration.
esxi:vmkernel
VMFS file creation
esxi:vob
NFS/remote access logs
esxi:shell
invoked remote scripts (esxcli)
[SnapshotFrequency]
How often snapshots are mounted or restored from peer nodes
[RemoteWriteVolume]
Threshold for staging behavior vs. backup/operational activity
[StorageMountPaths]
Common local destinations for incoming data
AN0198
Analytic 0198
IaaS
Detects remote write activity across cloud VMs or object storage buckets within the same region/account that correlate with data aggregation across hosts.
AWS:CloudTrail
GetObject, CopyObject
AWS:VPCFlowLogs
Traffic between instances
esxi:hostd
process execution across cloud VM
[BucketNamePatterns]
Destination naming convention used for staging (e.g., temp-store)
[IAMContext]
IAM role or user performing multi-host write ops
[TransferWindow]
Burst of high-volume inter-VM transfers indicating staging