AN0040
Analytic 0040
Windows
Detects staging of sensitive files into temporary or public directories, compression with 7zip/WinRAR, or batch copy prior to exfiltration.
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
[StagingDirectoryList]
Temp folders or user profile staging directories
[CompressionToolList]
7z.exe, rar.exe, zip.exe paths
[TimeWindow]
Temporal bounds for detecting batch staging activities
AN0041
Analytic 0041
Linux
Detects script or user activity copying files to a central temp or /mnt directory followed by archive/compression utilities.
auditd:SYSCALL
creat
auditd:SYSCALL
execve
[StagingDirectoryList]
e.g., /tmp/, /var/tmp/, /mnt/
[ArchivingCommandPatterns]
grep for 'tar', 'zip', 'gzip', '7z'
[UserContext]
Interactive or elevated shells running archiving commands
AN0042
Analytic 0042
macOS
Detects files collected into user temp or shared directories followed by compression with ditto, zip, or custom scripts.
macos:unifiedlog
file events
macos:unifiedlog
exec logs
[CompressionUtilityList]
e.g., 'ditto', 'zip', 'tar'
[SharedDirectoryIndicators]
e.g., /Users/Shared/ or /private/tmp/
[ScriptInvocationContext]
osascript or Terminal automation by non-GUI processes
AN0043
Analytic 0043
IaaS
Detects virtual disk expansion or file copy operations to cloud buckets or mounted volumes from isolated instances.
AWS:CloudTrail
GetObject, CopyObject
gcp:audit
Write operations to storage
[CloudBucketList]
Staging bucket or mount point for data
[InstanceTag]
Behavior restricted to specific ephemeral instances
[ObjectWriteThreshold]
Volume or size of files pushed in burst
AN0044
Analytic 0044
ESXi
Detects snapshots or data stored in VMFS volumes from root CLI or remote agents.
esxi:vmkernel
VMFS access logs
esxi:shell
snapshot create/copy, esxcli
[SnapshotFrequency]
Number of snapshots in short time period
[AccessUserList]
Non-admins or automation accounts writing to datastores
[CLIContext]
Manual or unexpected API calls triggering snapshots