Hunting for data staging before exfiltration
Skill autohandai/community-skills/hunting-for-data-staging-before-exfiltration
A collection of curated, useful, and safe skills for Autohand Code CLI Agent
npx -y skills add autohandai/community-skills --skill hunting-for-data-staging-before-exfiltrationAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 9 stars9 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.3 KB, as published. Nobody here has run it
Hunting for Data Staging Before Exfiltration
Overview
Before exfiltrating data, adversaries typically stage collected files in a central location (MITRE ATT&CK T1074). This involves creating archives with tools like 7-Zip, RAR, or tar, consolidating files from multiple directories, and using temporary or hidden staging directories. This skill detects staging behavior by analyzing process creation logs for archiver activity, monitoring file system events in common staging paths, and identifying anomalous file consolidation patterns.
Prerequisites
- EDR or Sysmon telemetry with process creation and file system events
- Windows Event Logs (Event ID 4688) or Sysmon Event ID 1, 11
- Python 3.8+ with standard library
- Access to process creation logs in JSON/CSV format
Steps
- Detect Archive Tool Execution — Monitor for 7z.exe, rar.exe, tar, zip, and WinRAR process creation with compression arguments
- Identify Staging Directories — Flag file writes to common staging locations (Recycle Bin, %TEMP%, ProgramData, hidden directories)
- Detect Large File Consolidation — Identify patterns of multiple file reads followed by writes to a single directory
- Monitor Sensitive Path Access — Track bulk reads from document directories, database paths, and network shares
- Analyze Archive Metadata — Extract and analyze archive file sizes, creation times, and source paths
- Score Staging Risk — Apply heuristic scoring based on archive size, source diversity, staging path suspicion, and timing
- Generate Hunt Report — Produce a structured report with staging event timeline and MITRE ATT&CK mapping
Expected Output
- JSON report of detected staging events with risk scores
- Archive creation timeline with source file analysis
- MITRE ATT&CK mapping (T1074.001, T1074.002, T1560)
- Staging directory heat map showing suspicious write activity