PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths

title: PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths
id: 98c30d21-8fb2-49ea-a200-06c99687c5cd
related:
  - id: 71ff406e-b633-4989-96ec-bc49d825a412
    type: similar
  - id: daf7eb81-35fd-410d-9d7a-657837e602bb
    type: similar
  - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
    type: similar
  - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
    type: derived
status: test
description: This rule identifies PowerShell process command lines that invoke the Compress-Archive cmdlet while directing output to commonly abused temporary locations such as %TEMP%, %AppData%\Local\Temp, or Windows\Temp. Attackers may archive collected files to make stolen data more portable and reduce the amount of data transferred during exfiltration. The detection relies on process creation telemetry capturing the PowerShell command line arguments that include the Compress-Archive invocation and its DestinationPath values.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_zip_compress.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2021-07-20
modified: 2022-10-09
tags:
  - attack.collection
  - attack.t1074.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - Compress-Archive -Path*-DestinationPath $env:TEMP
      - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\
      - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1