agentsclimarketplace
Sign in

Hunting data staging and archiving

Skill meltedinhex/analyst-ai-pack/skills/hunting-data-staging-and-archiving

Hunts for pre-exfiltration data staging and archiving by detecting archive-tool execution (rar, 7z, zip, tar), large compressed files written to staging directories, and collection into a single location before transfer. Activates for requests to hunt data staging, detect pre-exfil archiving, or find collection and compression before exfiltration.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill hunting-data-staging-and-archiving

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 437 tokens by cl100k_base, as published. Nobody here has run it

Hunting Data Staging and Archiving

When to Use

  • You have process-creation and file telemetry and want to detect an actor collecting and compressing data into a staging location before exfiltration.
  • You are looking for the step between collection and exfil.

Do not use this to alert on all archive usage — backups and legitimate compression are common. Hunt the staging context (temp paths, password-protected archives, unusual parents).

Prerequisites

  • Process-creation events (with command line) and/or file-write telemetry.

Workflow

Step 1: Detect archive-tool execution

python scripts/analyst.py hunt events.csv

Flags rar/7z/zip/tar/winrar execution with compression + password flags (a -hp, -p, -r), and archives written to staging paths (%TEMP%, %APPDATA%, ProgramData, C:\Users\Public).

Step 2: Surface large/odd archives

Highlight large archive writes and archives created by unusual parents (Office, script hosts, remote-exec services).

Step 3: Confirm

Correlate with subsequent outbound transfer of the archive (pair with the unusual-outbound hunt).

Step 4: Operationalize

Write a detection for password-protected archiving into staging directories.

Validation

  • Archive execution is flagged with the compression/password flags, not tool presence alone.
  • Staging-path writes are surfaced with the file path.
  • Findings map to ATT&CK T1074 / T1560.

Pitfalls

  • Legitimate backup/IT archiving — corroborate with path, parent, and password use.
  • Built-in tar/Compress-Archive blending into normal admin activity.
  • Split archives (.r00, .z01) that evade single-file size thresholds.

References

What ships with it: 3 files

4.5 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.