Data Exfil - Public Staging Directory Creation (T1074.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects the creation of localized staging directories with suspicious names in public paths, used to temporarily hold compressed data before exfil. The rule specifically looks for folder creations under 'C:\Users\Public\' with names like 'Exfil', 'Data', 'Staging', or 'Dump'.