How do you detect data staging and archive creation?

Combine process and file telemetry. On process creation, flag 7-Zip, WinRAR or tar with password, header-encryption or split-volume switches, or recursive wildcards over shares, and match on the original file name so renamed copies still fire. On file events, alert on bursts of large archives in unusual directories or from non-backup processes. Correlate with prior bulk reads on file shares and with a following upload tool or outbound connection. Allowlist backup and developer tooling by parent process and account.

Detecting Data Staging and Archive Creation Before Egress

Operators stage data on a file server or a chosen workstation, compress it with an archiver, and often encrypt and split it so it transfers faster and escapes content inspection. Because staging happens on hosts you can instrument, it is frequently a better detection point than the egress itself.

Signals at a Glance

Signal	Where	ATT&CK
Archiver with password or header-encryption switches	Process creation	T1560.001
Archiver invoked on a server with recursive wildcards over shares	Process creation	T1560.001
Multi-volume output (`-v100m` style) in a temp or public directory	Process creation, Sysmon 11	T1074.001
Large archive created in `C:\Users\Public`, `C:\PerfLogs` or `C:\Windows\Temp`	Sysmon 11, EDR	T1074.001
Archiver parent is a remote execution service or scripting engine	Process tree	T1560

Process Detection

The archivers are legitimate software, so the discriminators are the switches and the context. Passwords, header encryption, wildcards and volume splitting are uncommon in normal desktop use and routine in staging:

title: Archive Utility Used For Encrypted Or Split Staging
logsource:
  category: process_creation
  product: windows
detection:
  tool:
    - Image|endswith:
        - '\\7z.exe'
        - '\\7za.exe'
        - '\\rar.exe'
        - '\\winrar.exe'
    - OriginalFileName:
        - '7z.exe'
        - '7za.exe'
        - 'WinRAR.exe'
  action:
    CommandLine|contains:
      - ' a '
  protect:
    CommandLine|contains:
      - ' -p'
      - ' -hp'
      - ' -mhe'
  split:
    CommandLine|re: ' -v[0-9]+[kmg]'
  condition: tool and action and (protect or split)
level: medium
# tune/validate: allowlist backup and developer tooling by parent image and account

Hunt the file side as well. Many archives written in a short window, from a process that is not a backup agent, to a directory regular users rarely use, is the staging footprint even when the command line is hidden:

// Microsoft Defender XDR (KQL) - burst of large archive creation
// tune/validate: raise thresholds on build servers and backup targets
DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileCreated"
| where FileName matches regex @"(?i)\.(7z|rar|zip|tar|gz|tgz|bz2|001)$"
| where FileSize > 100000000
| summarize archives = count(), totalGB = round(sum(FileSize) / 1073741824.0, 2),
            dirs = dcount(FolderPath) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where archives >= 3 or totalGB > 5
| order by totalGB desc

Reading the Context

Read activity before the archive: bulk file reads on a share from one account, visible in file-server auditing, precede almost every staging event.
Look at what happens next. An archive followed within an hour by an upload tool, a new outbound connection or a copy to removable media completes the chain.
On Linux, watch tar, zip or 7z under /tmp, /dev/shm and /var/tmp, particularly with openssl enc or gpg in the same pipeline.
Deleted archives matter: a large file created and removed after a transfer is a cleanup indicator worth correlating.

Vetted sources

SigmaHQ rules for archiver abuse and suspicious staging directories, Elastic detections for encrypted archive creation, and DFIR reports on ransomware staging behaviour. Baseline your own environment — developers, finance and backup jobs all create large archives legitimately.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Process Detection

Reading the Context

Build Detections That Fire

Data Exfiltration Detection

Detection Hub

Rclone Exfil Detection

USB Exfil Detection