PowerShell Compress-Archive Cmdlet Execution for Data Compression

title: PowerShell Compress-Archive Cmdlet Execution for Data Compression
id: 28cbd228-36d4-40fe-b8c1-1d7352205820
status: test
description: This rule identifies PowerShell script block content that includes the Compress-Archive cmdlet, indicating that the script is compressing folders or files. Attackers may use compression to package collected data, making it more portable and potentially reducing the amount of data transferred for later collection or exfiltration. The detection relies on PowerShell Script Block Logging telemetry capturing the script text that contains "Compress-Archive".
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560/T1560.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_compress_archive_usage.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-12-15
tags:
  - attack.exfiltration
  - attack.collection
  - attack.t1560
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Compress-Archive
  condition: selection
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a
    type: derived