huntrule

Windows PowerShell module usage: Compress-Archive to store archives in Temp locations

Alerts on PowerShell Compress-Archive output written to common temp staging directories.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_module
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2021-07-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies PowerShell module activity that invokes Compress-Archive with DestinationPath set to common temporary directories, including $env:TEMP, AppData\Local\Temp, and Windows\Temp. Compressing data for staging in temp folders can reduce size and improve portability before exfiltration. It relies on telemetry from PowerShell module command context that includes the executed cmdlet parameters and destination paths.

Reporting behind it

Related detections9 linkedT1074.001 — drag to rearrange
Suspicious NimDoor Exfiltration Staging Directory Creation via uplex Prefix (via file_event)
Suspicious PowerShell Payload Staging in HKCU Printers Registry Key
Suspicious Robocopy of Signal Directory to Public Staging Path by UNC1151 (via process_creation)
Suspicious Command Output Redirection to Windows Debug Out File (via process_creation)
Suspicious Archive Staging to ProgramData NetWorks Path via RAR (via process_creation)
Malicious Empyrean Stealer Staging Files in AppData (via file_event)
TerraStealerV2 Data Staging in Bay0NsQIzx Package Directory (via file_event)
Suspicious C2Looper Shell Output Artifact File Creation (via file_event)
Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)
Windows PowerShell module usage: Compress-Archive to store archives in Temp locations
Pivot detection · T1074.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.