In double-extortion cases the operator copies data first and encrypts later. The collection phase leaves a distinct footprint: an archiver run across file shares, a large password-protected archive appearing in an odd directory, or one account reading far more files than usual. Catching staging can stop both the theft and the encryption.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| Archiver with password or recursive flags on a share path | Sysmon 1, EDR | T1560.001 |
| Large archive created in a temp, public or recycle folder | Sysmon 11, EDR | T1074.001 |
| Single account reading thousands of files in minutes | 5145, file audit | T1039 |
| Staging folder on a server growing rapidly | File telemetry | T1074.002 |
| Unusual archiver binary location or renamed copy | EDR | T1036 |
Archiver Behaviour
7-Zip, WinRAR and similar tools are common in IT, so the process alone is not an alert. The combination is: a password flag, a share or user-profile source, and a destination in a location people do not normally archive to:
title: Archiver Staging Data with Password
logsource:
category: process_creation
product: windows
detection:
tool:
Image|endswith:
- '\7z.exe'
- '\7za.exe'
- '\rar.exe'
- '\winrar.exe'
password:
CommandLine|contains:
- ' -p'
- ' -hp'
recursive:
CommandLine|contains:
- ' a '
- ' -r'
condition: tool and password and recursive
level: medium
# tune/validate: raise to high when the source path is a file share or the host is a server
Read Volume and Staging Growth
A staging account reads broadly. Count distinct files accessed per account and per source, and compare with that account’s own history:
// Defender / Sentinel (KQL) - large archive written on a server DeviceFileEvents | where ActionType == "FileCreated" | where FileName endswith ".zip" or FileName endswith ".7z" or FileName endswith ".rar" | where FileSize > 500000000 | join kind=inner (DeviceInfo | where OSPlatform startswith "WindowsServer" | distinct DeviceId) on DeviceId | project Timestamp, DeviceName, FolderPath, FileName, FileSize, InitiatingProcessAccountName, InitiatingProcessCommandLine // tune/validate: exclude sanctioned backup and archiving jobs by account and path
- Enable file-share auditing on the data stores that matter most (finance, legal, source code, HR) rather than everywhere.
- Correlate staging with later egress to a storage service or an unfamiliar destination; either alone is weaker.
- Preserve the archive and its command line. They define the scope of what was taken for notification decisions.
SigmaHQ archive and collection rules, Elastic data-staging detections, Splunk ESCU archive analytics, and CISA #StopRansomware guidance on exfiltration. Backup and archiving jobs are legitimate large-archive writers, so baseline them first.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts