Hunting Collection: Catching Data Staging Before It Leaves

Somewhere between an attacker finding valuable data and actually getting it out of your network, there’s usually a staging phase—gathering, compressing, and organizing data into a form that’s ready to move. This window, covered briefly in the ransomware piece earlier in this series, deserves its own dedicated treatment, because collection hunting is genuinely one of the last realistic opportunities to prevent data loss before it actually happens.

Why Collection Deserves More Attention Than It Typically Gets

Most organizations’ detection stacks are heavily weighted toward catching earlier kill chain stages—initial access, execution—or the final, unambiguous act of exfiltration itself. Collection sits in between, and it’s frequently under-instrumented precisely because it doesn’t look as dramatically obvious as either endpoint. An attacker methodically copying files from various locations into a single staging directory doesn’t trigger the same alarm bells as, say, an obvious malware execution event, even though it’s arguably a more urgent moment to catch.

Automated Collection and Bulk File Access Patterns

A common collection pattern involves scripted or automated bulk access to files across a target’s file systems or shares, systematically pulling documents matching certain criteria—file types, keywords in file names, or specific directory locations known to hold valuable data. A hunt hypothesis worth building: monitor for unusually high-volume file access events from a single account or process within a short window, particularly access spanning file types or locations inconsistent with that account’s normal, established usage pattern. Say a marketing team member’s account normally touches a handful of shared drive folders relevant to their role—that same account suddenly accessing several hundred files across finance and legal shares within an hour is a meaningfully different pattern worth immediate investigation, regardless of whether the account technically has permission to access those locations.

Archive Creation as a Distinctive Staging Signal

Attackers frequently compress collected data into archive files before exfiltration, both to reduce transfer size and to consolidate what might be scattered across many individual files into a single package. This is a genuinely useful hunting signal because archive creation, at scale, is somewhat distinctive compared to normal user behavior. A hunt hypothesis worth building: monitor for the creation of unusually large archive files, particularly by processes or accounts that don’t normally create archives as part of their routine work, and particularly where the archive is created in an unusual location (a temporary directory, rather than a location associated with legitimate backup or archival processes).

Say your organization has a legitimate, known backup process that creates archives nightly from specific, expected locations—a hunt tuned to exclude that known-legitimate pattern while flagging archive creation from any other source becomes considerably more precise than a generic “any archive creation” alert, which would otherwise drown in your own legitimate backup activity.

Screen Capture and Input Capture for Sensitive Data Collection

Beyond file-based collection, some intrusions specifically target data that isn’t necessarily stored in accessible files at all—capturing screen contents, keystrokes, or clipboard data to gather credentials or sensitive information displayed only transiently. This category typically requires EDR-level behavioral detection watching for screen capture or clipboard monitoring API calls, since it’s much harder to observe through traditional file-access or network-based logging alone. If your endpoint tooling surfaces this telemetry, a hunt hypothesis worth building: monitor for processes making repeated or scheduled screen capture or clipboard access calls, particularly processes with no legitimate documented reason to perform this kind of monitoring.

Data From Cloud Storage and SaaS Applications

As more sensitive data lives in cloud storage and SaaS platforms rather than traditional file shares, collection activity increasingly targets these environments directly—bulk downloads from cloud storage, systematic export of data from SaaS applications like CRM or HR systems. This requires the cloud and SaaS logging sources discussed in the earlier data ecosystem piece, and it’s a category worth building dedicated hunting attention around given how much valuable data has migrated into exactly these platforms. A hunt hypothesis worth developing: monitor for unusually large or broad data export activity from cloud storage or SaaS applications, particularly exports initiated by accounts or at times inconsistent with that resource’s normal usage pattern.

Staging Location Analysis: Where Collected Data Tends to Land

A useful complementary approach focuses less on the act of collection itself and more on where collected data tends to accumulate before exfiltration—temporary directories, unusual locations on otherwise unremarkable hosts, or locations that don’t correspond to any legitimate business process. A hunt hypothesis worth building: periodically scan for unusually large accumulations of diverse file types in locations that don’t match known legitimate storage or backup patterns, since a staging directory containing a mix of documents, spreadsheets, and database exports gathered from across the environment is a distinctive pattern that doesn’t typically arise from normal, legitimate business activity.

Treating Confirmed Collection as an Urgent, Time-Sensitive Signal

Given that collection activity typically precedes exfiltration by a matter of hours or at most a few days rather than weeks, a confirmed collection finding deserves genuinely urgent handling—closer to the response cadence appropriate for a confirmed privilege escalation finding than a routine hunting result. The window between confirmed staging and actual data loss is often the last realistic opportunity to prevent the more damaging outcome entirely, which makes the speed of response here matter more than in most other hunting categories covered in this series.