huntrule

PowerShell Classic Compress-Archive staging in TEMP or Temp directories

Alerts on PowerShell Compress-Archive output targeting common Temp directories for data staging.

FreeReviewedSigma · Medium · v2
Product
windows
Service
powershell-classic
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2021-07-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell Classic usage of the Compress-Archive cmdlet where the destination is set to $env:TEMP or common temporary directories (including AppData\Local\Temp and Windows\Temp). Compressing files into staging locations can help an attacker package collected data to be more portable and reduce what must be transmitted during exfiltration. The detection relies on PowerShell command content (script text or command lines) containing specific Compress-Archive DestinationPath patterns targeting these temp locations.

Reporting behind it

Related detections8 linkedT1074.001 — drag to rearrange
Malicious Empyrean Stealer Staging Files in AppData (via file_event)
TerraStealerV2 Data Staging in Bay0NsQIzx Package Directory (via file_event)
Suspicious C2Looper Shell Output Artifact File Creation (via file_event)
Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)
Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)
PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths
PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging
Windows PowerShell module usage: Compress-Archive to store archives in Temp locations
PowerShell Classic Compress-Archive staging in TEMP or Temp directories
Pivot detection · T1074.001 · 8 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.