huntrule

PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths

Flags PowerShell Compress-Archive usage writing archives to %TEMP%, AppData Local Temp, or Windows Temp.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2021-07-20
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies PowerShell process command lines that invoke the Compress-Archive cmdlet while directing output to commonly abused temporary locations such as %TEMP%, %AppData%\Local\Temp, or Windows\Temp. Attackers may archive collected files to make stolen data more portable and reduce the amount of data transferred during exfiltration. The detection relies on process creation telemetry capturing the PowerShell command line arguments that include the Compress-Archive invocation and its DestinationPath values.

Reporting behind it

Related detections8 linkedT1074.001 — drag to rearrange
Malicious Empyrean Stealer Staging Files in AppData (via file_event)
TerraStealerV2 Data Staging in Bay0NsQIzx Package Directory (via file_event)
Suspicious C2Looper Shell Output Artifact File Creation (via file_event)
Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)
Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)
PowerShell Classic Compress-Archive staging in TEMP or Temp directories
PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging
Windows PowerShell module usage: Compress-Archive to store archives in Temp locations
PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths
Pivot detection · T1074.001 · 8 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.