--- analysis: A standard detection rule might flag any archive creation in Temp, but this hunt pivots between the file system, rare outbound network prevalence, and behavioral DNS to find the connected attack path. blind_spots: - id: no-process-to-network-mapping question: Which process initiated the rare outbound connection? requires: endpoint agent with process-to-socket correlation risk: If only flow logs are available, the analyst cannot definitively link the process creating archives to the process communicating externally. stage: network-exfiltration-c2 - id: encrypted-exfiltration question: What was the content of the outbound data transfer? requires: TLS decryption/inspection at the perimeter risk: Adversaries using HTTPS or custom encryption hide the volume and nature of exfiltrated data. stage: network-exfiltration-c2 coverage: - stage: file-system-data-staging status: covered steps: - identify-data-staging - stage: network-exfiltration-c2 status: covered steps: - rare-outbound-connections - rare-dns-lookups - reason: Handled by the first hunt in this series focusing on perimeter vulnerabilities. stage: initial-access-web-exploit status: out_of_scope - reason: Identity-based pivots are handled in the Cross-Environment Pivot hunt. stage: identity-account-manipulation status: out_of_scope - reason: Cloud control plane changes belong to a cloud-focused hunt. stage: cloud-resource-reconfiguration status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Data staging and exfiltration represent the completion of an adversary's mission. Detecting these behaviors across the endpoint and network surfaces is the final opportunity to prevent material impact. methodology: model-assisted trigger: intel-report hypothesis: An adversary has staged sensitive information in temporary directories and is exfiltrating that data via rare outbound network connections or DNS lookups. labels: - hunt - attack.t1074.001 - attack.t1041 - attack.t1071.001 name: Endpoint Data Staging and Exfiltration parameters: lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-09-17' ref: hunt-parameters type: number rare_threshold: default: '3' description: The maximum number of hosts a value can appear on to be considered rare. from: kind: manual observed: '2026-09-17' ref: hunt-parameters type: number scope_hosts: default: [] description: Comma-separated hostnames to narrow the search; leave empty for fleet-wide. from: kind: manual observed: '2026-09-17' ref: hunt-parameters type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on workstations and servers with access to sensitive repositories first. Use a 14-day lookback to capture both staging and exfiltration, which often occur with a significant time gap. references: - name: 'Inside the Modern SOC: Defending the Cross-Environment Pivot' url: https://unit42.paloaltonetworks.com/soc-cross-environment-pivot/ related: - hunt: cloud-storage-exfiltration reason: This hunt focuses on direct network exfiltration; exfiltration via cloud synchronization requires cloud-native audit logs. relation: out-of-scope-alternative - hunt: identity-cloud-pivot-web-exploits relation: follows scenario: stages: - name: Web Application Exploitation observables: - exploitation of internet-facing web servers - malicious http requests to public-facing applications slug: initial-access-web-exploit tactic: initial-access techniques: - T1190 - name: SaaS and Identity Manipulation observables: - unfamiliar applications requesting elevated permissions - permissions changes within SaaS applications - OAuth or SAML authentication anomalies slug: identity-account-manipulation tactic: privilege-escalation techniques: - T1098 - name: Cloud Environment Provisioning observables: - provisioning of cloud resources outside of normal activity - reconfiguration of cloud assets by unusual administrator accounts slug: cloud-resource-reconfiguration tactic: persistence techniques: - T1078 - name: Data Staging for Exfiltration observables: - staging of sensitive data in temporary or unusual directories - unexpected file creation patterns on endpoints slug: file-system-data-staging tactic: collection techniques: - T1074 - name: Exfiltration over Command and Control observables: - new network connections between systems that rarely communicate - data transfer to unfamiliar external IP addresses - C2 communication over established protocols slug: network-exfiltration-c2 tactic: exfiltration techniques: - T1041 summary: Adversaries exploit internet-facing applications to gain a foothold before pivoting across cloud and SaaS environments using compromised credentials. The attack culminates in the staging of sensitive data on endpoints and exfiltration via command-and-control channels. series: index: 2 slug: inside-the-modern-soc-defending-the-cross-environment-pivot title: 'Inside the Modern SOC: Defending the Cross-Environment Pivot' total: 2 severity: medium targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent network: category: network name: Network telemetry telemetry: - network tlp: clear type: investigation --- # Endpoint Data Staging and Exfiltration This hunt targets the final stages of an intrusion: collection and exfiltration. It identifies the creation of compressed archives in user-writable paths like Public or Temp on Windows and /tmp or /dev/shm on Linux, then correlates that activity with rare outbound network connections and behavioral DNS anomalies. An agent evaluates the combined evidence to distinguish administrative archiving from malicious data theft. ## identify-data-staging Locate hosts with archives created in writable directories. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Rows naming archives created in user-writable paths. Silence suggests no common staging activity occurred. reads: - device_hostname - file_path - process_name - activity_id - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE activity_id = 1 AND (LOWER(file_path) LIKE '%.zip' OR LOWER(file_path) LIKE '%.7z' OR LOWER(file_path) LIKE '%.rar') AND (LOWER(file_path) LIKE '%\\users\\public\\%' OR LOWER(file_path) LIKE '%\\temp\\%' OR LOWER(file_path) LIKE '%\\appdata\\local\\temp\\%' OR LOWER(file_path) LIKE '/tmp/%' OR LOWER(file_path) LIKE '/var/tmp/%' OR LOWER(file_path) LIKE '/dev/shm/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## parallel-evidence parallel: - → rare-outbound-connections - → rare-dns-lookups join: → triage-exfiltration ## rare-outbound-connections Find connections to external IP addresses that appear on fewer than the threshold number of hosts. ```sqlite target=network role=baseline params=(lookback_days=lookback_days, rare_threshold=rare_threshold, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: An IP address visited by only one or two hosts, potentially representing an exfiltration drop site. prevalence: by: device_hostname key: - dst_endpoint_ip - process_name rare_below: 3 reads: - dst_endpoint_ip - device_hostname - direction - disposition - process_name - time silence: not_evidence_of_absence source: hb_network_connection verified: dry-run verified_at: '2026-09-20' ~~~ SELECT dst_endpoint_ip, process_name, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS connection_count, GROUP_CONCAT(DISTINCT device_hostname) AS affected_hosts FROM hb_network_connection WHERE direction = 'outbound' AND disposition = 'Allowed' AND dst_endpoint_ip NOT LIKE '10.%' AND dst_endpoint_ip NOT LIKE '192.168.%' AND dst_endpoint_ip NOT LIKE '172.16.%' AND dst_endpoint_ip NOT LIKE '172.17.%' AND dst_endpoint_ip NOT LIKE '172.18.%' AND dst_endpoint_ip NOT LIKE '172.19.%' AND dst_endpoint_ip NOT LIKE '172.2%.%' AND dst_endpoint_ip NOT LIKE '172.3%.%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip, process_name HAVING host_count <= {{rare_threshold}} ``` ## rare-dns-lookups Identify rare domain queries on suspect hosts that might indicate C2 or exfiltration endpoints. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, rare_threshold=rare_threshold, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Domain queries unique to a small set of hosts. Silence suggests no unusual DNS patterns for the lookback period. prevalence: by: device_hostname key: - query_hostname rare_below: 3 reads: - device_hostname - query_hostname - process_name - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT query_hostname, COUNT(DISTINCT device_hostname) AS host_count, GROUP_CONCAT(DISTINCT device_hostname) AS hosts, GROUP_CONCAT(DISTINCT process_name) AS processes FROM hb_dns_activity WHERE query_hostname NOT LIKE '%.local' AND query_hostname NOT LIKE '%.internal' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY query_hostname HAVING host_count <= {{rare_threshold}} ``` ## triage-exfiltration ```agent target=hunter cite: required context: - identify-data-staging - rare-outbound-connections - rare-dns-lookups max_iterations: 5 objective: Review the staging file events, rare network connections, and DNS lookups. Identify if a single host performed all three or if the process creating the archives also initiated the rare network traffic. Provide a verdict of malicious, suspicious, or benign. success_criteria: A per-host verdict citing specific rows from all three inputs. tools: - endpoint - network ``` ## route-verdict if~: "The triage verdict is malicious for at least one host based on the correlation of archive creation and outbound exfiltration signals." (confidence: high, judge=hunter) then: → isolate-host indeterminate: → manual-investigation unavailable: → manual-investigation (blind_spot: no-process-to-network-mapping) else: → hunt-completion ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host from the network immediately to halt exfiltration. Collect the archives identified in the staging step for forensic analysis. ``` → manual-investigation ## manual-investigation ```manual target=analyst Review the correlated events. Check the process parentage for the archive creation. Determine if the rare IP addresses belong to legitimate business services not yet in the baseline. ``` → hunt-completion ## hunt-completion ```manual target=analyst Log the results. If legitimate tools were identified as rare, add their destination IPs to the exclusion list. Update the staging directory patterns if new adversary tradecraft was observed. ``` → end