huntrule

Windows PowerShell module usage: Compress-Archive to store archives in Temp locations

Alerts on PowerShell Compress-Archive output written to common temp staging directories.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_module
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2021-07-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies PowerShell module activity that invokes Compress-Archive with DestinationPath set to common temporary directories, including $env:TEMP, AppData\Local\Temp, and Windows\Temp. Compressing data for staging in temp folders can reduce size and improve portability before exfiltration. It relies on telemetry from PowerShell module command context that includes the executed cmdlet parameters and destination paths.

Reporting behind it

Related detections8 linkedT1074.001 — drag to rearrange
Malicious Empyrean Stealer Staging Files in AppData (via file_event)
TerraStealerV2 Data Staging in Bay0NsQIzx Package Directory (via file_event)
Suspicious C2Looper Shell Output Artifact File Creation (via file_event)
Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)
Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)
PowerShell Classic Compress-Archive staging in TEMP or Temp directories
PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths
PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging
Windows PowerShell module usage: Compress-Archive to store archives in Temp locations
Pivot detection · T1074.001 · 8 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.