PowerShell Compress-Archive Cmdlet Execution for Data Compression
Flags PowerShell scripts using the Compress-Archive cmdlet, consistent with local data packaging before collection or exfiltration.
- Product
- windows
- Category
- ps_script
- Author
- Timur Zinniatullin, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-21
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell script block content that includes the Compress-Archive cmdlet, indicating automated compression of files or folders. Adversaries may compress collected or sensitive data to reduce size and improve portability ahead of exfiltration. The detection relies on Script Block Logging telemetry capturing PowerShell script text that contains the cmdlet name.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Compress-Archive Cmdlet Execution for Data Compression
id: 28cbd228-36d4-40fe-b8c1-1d7352205820
status: test
description: This rule identifies PowerShell script block content that includes the Compress-Archive cmdlet, indicating automated compression of files or folders. Adversaries may compress collected or sensitive data to reduce size and improve portability ahead of exfiltration. The detection relies on Script Block Logging telemetry capturing PowerShell script text that contains the cmdlet name.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560/T1560.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_compress_archive_usage.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-12-15
tags:
- attack.exfiltration
- attack.collection
- attack.t1560
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains: Compress-Archive
condition: selection
falsepositives:
- Likely
level: low
license: DRL-1.1
related:
- id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a
type: derived