Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Hunting for Data Staging Before Exfiltration · mukul975 | DecimalAI

Hunting For Data Staging Before Exfiltration

SkillScore14Maintained

hunting-for-data-staging-before-exfiltration

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hunting-for-data-staging-before-exfiltration/SKILL.md

decimalai skills pull hunting-for-data-staging-before-exfiltration --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hunting-for-data-staging-before-exfiltration/SKILL.md https://app.decimal.ai/s/hunting-for-data-staging-before-exfiltration/SKILL.md

Raw file: /s/hunting-for-data-staging-before-exfiltration/SKILL.md ↗ · machine-readable summary at /s/hunting-for-data-staging-before-exfiltration.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +9% lift+8% tokens0% turns14% of whole cases pass with skill (3/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-14	✗→✓	▲ Improved	—	—
case-08	✗→✓	▲ Improved	—	—
case-13	✓→✓	＝ Same ✓	—	—
case-17	✗→✗	＝ Same ✗	—	—
case-03	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/hunting-for-data-staging-before-exfiltration/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 2 files · scripts

Skill contents

scripts/

references/

SKILL.md

Hunting for Data Staging Before Exfiltration

Overview

Before exfiltrating data, adversaries typically stage collected files in a central location (MITRE ATT&CK T1074). This involves creating archives with tools like 7-Zip, RAR, or tar, consolidating files from multiple directories, and using temporary or hidden staging directories. This skill detects staging behavior by analyzing process creation logs for archiver activity, monitoring file system events in common staging paths, and identifying anomalous file consolidation patterns.

When to Use

When investigating security incidents that require hunting for data staging before exfiltration
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

EDR or Sysmon telemetry with process creation and file system events
Windows Event Logs (Event ID 4688) or Sysmon Event ID 1, 11
Python 3.8+ with standard library
Access to process creation logs in JSON/CSV format

Steps

Detect Archive Tool Execution — Monitor for 7z.exe, rar.exe, tar, zip, and WinRAR process creation with compression arguments
Identify Staging Directories — Flag file writes to common staging locations (Recycle Bin, %TEMP%, ProgramData, hidden directories)
Detect Large File Consolidation — Identify patterns of multiple file reads followed by writes to a single directory
Monitor Sensitive Path Access — Track bulk reads from document directories, database paths, and network shares
Analyze Archive Metadata — Extract and analyze archive file sizes, creation times, and source paths
Score Staging Risk — Apply heuristic scoring based on archive size, source diversity, staging path suspicion, and timing
Generate Hunt Report — Produce a structured report with staging event timeline and MITRE ATT&CK mapping

Expected Output

JSON report of detected staging events with risk scores
Archive creation timeline with source file analysis
MITRE ATT&CK mapping (T1074.001, T1074.002, T1560)
Staging directory heat map showing suspicious write activity

Illustrative Want to see what hunting-for-data-staging-before-exfiltration would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 08:31 UTC · 22 cases

Lift

+9%

14% vs 5%

Agent turns

1.0 vs 1.0

Tokens

+8%

2,328.23 vs 2,164.86

fail → pass · 2pass → pass · 1fail → fail · 19

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-17 Why are hidden directories or system reserve locations prioritized when assessing staging path suspicion during threat hunting?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During an incident, we need to hunt for unauthorized memory dumping of the Local Security Authority Subsystem Service (LSASS) using tools like ProcDump or Mimikatz. What telemetry and detection logic should be applied?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 After detecting a suspicious compression command, what key archive metadata elements should be extracted and analyzed to evaluate the scale and impact of the staging event?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-14 We are designing an automated hunt rule that outputs a report whenever potential data staging is detected. What essential structural components and mapping elements must be included in the generated output to assist SOC investigation?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 Threat actors stage data by gathering high-value files prior to compression. Which three specific categories of sensitive file paths on host systems should be monitored for anomalous bulk file read operations?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Our SOC is auditing log sources before launching a data staging hunt project. What two primary telemetry data streams are required from host endpoints?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 To reduce false positives when hunting for staging activity, we want to implement a heuristic scoring system that evaluates individual archive creation events. What four key behavioral dimensions or factors should contribute to the composite risk score?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 How does temporal proximity between bulk sensitive file reads and archiver command execution influence the staging risk score?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Specify the required JSON structure fields when serializing a detected data staging alert for SIEM consumption.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 When searching process creation telemetry for compression activity associated with data staging, analysts usually filter for native and third-party compression executables. Which common archive tools or command-line binaries should be monitored?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 SOC managers want a visual summary to identify directories undergoing anomalous staging activity across the fleet. What data representation should be generated to highlight locations experiencing suspicious file write volumes?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 We suspect an attacker is actively transferring stolen files out of our network via outbound HTTPS connections to a suspicious external IP. Recommend a threat hunting procedure to analyze network flow logs and web proxy traffic for data exfiltration volume and continuous outbound channels.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An attacker used command-line utility compression to pack staging files before transport. What specific MITRE ATT&CK technique ID covers Archive Collected Data?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Our SOC team wants to hunt for unauthorized Windows service creations and registry modification for persistence across reboot. Provide a threat hunting guide targeting service installation events.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 When documenting detected data staging activities for our threat intelligence report, we need to map local file staging and remote file staging to their precise MITRE ATT&CK technique IDs under Data Staging. Which ATT&CK IDs correspond to local data staging and remote data staging?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 When hunting for staged archives, why is monitoring file write events to hidden directory attributes or $Recycle.Bin critical?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We are configuring log ingestion rules to detect command-line archive execution by attackers staging files. Our team uses standard Security Event Log auditing alongside Sysmon. Which specific Windows Security Event ID and Sysmon Event ID must be ingested to capture process creation with full command lines?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 An analyst is reviewing Sysmon Event ID 1 logs and sees '7z.exe a -hpSecretPass C:\ProgramData\update.zip C:\Users\Administrator\Documents\'. What specific command-line argument indicates archive creation and what path indicates the staging location in this entry?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 A user process writes multiple files into C:\Windows\Temp. However, administrators routinely download installation files into that path. What pattern of file system events distinguishes malicious data consolidation staging from legitimate single-source file downloads?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 To detect staged file creation in hidden or temporary system folders, our threat hunting team needs to monitor file system modifications. Which specific Sysmon Event ID records file creation and file write events to disk?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Attackers often choose specific system directories on Windows hosts to hide staged archives prior to exfiltration because these paths blend in with normal administrative activity or elevated privileges. List four common suspicious target staging locations on a Windows host.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-20 We are building a custom analytical script to parse JSON and CSV process creation logs and extract archive creation timestamps and source paths. What programming environment standard should be specified for script compatibility?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +9 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 13.6%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 08:31 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run14

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-2% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.