Windows PowerShell module usage: Compress-Archive to store archives in Temp locations

Alerts on PowerShell Compress-Archive output written to common temp staging directories.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_module
Author: Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published: 2021-07-20
Updated: 2026-07-31

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1074.001Local Data Staging
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell module activity that invokes Compress-Archive with DestinationPath set to common temporary directories, including $env:TEMP, AppData\Local\Temp, and Windows\Temp. Compressing data for staging in temp folders can reduce size and improve portability before exfiltration. It relies on telemetry from PowerShell module command context that includes the executed cmdlet parameters and destination paths.

Reporting behind it

Related detections8 linkedT1074.001 — drag to rearrange

Malicious Empyrean Stealer Staging Files in AppData (via file_event)

TerraStealerV2 Data Staging in Bay0NsQIzx Package Directory (via file_event)

Suspicious C2Looper Shell Output Artifact File Creation (via file_event)

Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

PowerShell Classic Compress-Archive staging in TEMP or Temp directories

PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths

PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging

Windows PowerShell module usage: Compress-Archive to store archives in Temp locations

Pivot detection · T1074.001 · 8 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-compress-archive-staging-in-windows-temp-or-appdata-local-temp-daf7eb81

title: "Windows PowerShell module usage: Compress-Archive to store archives in Temp locations"
id: 6c8a2484-b8d6-4783-b368-432415d4560a
related:
  - id: 71ff406e-b633-4989-96ec-bc49d825a412
    type: similar
  - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
    type: similar
  - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
    type: similar
  - id: daf7eb81-35fd-410d-9d7a-657837e602bb
    type: derived
status: test
description: This rule identifies PowerShell module activity that invokes Compress-Archive with DestinationPath set to common temporary directories, including $env:TEMP, AppData\Local\Temp, and Windows\Temp. Compressing data for staging in temp folders can reduce size and improve portability before exfiltration. It relies on telemetry from PowerShell module command context that includes the executed cmdlet parameters and destination paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2021-07-20
modified: 2023-12-18
tags:
  - attack.collection
  - attack.t1074.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    ContextInfo|contains|all:
      - Compress-Archive -Path*-DestinationPath $env:TEMP
      - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\
      - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL