PowerShell Compress-Archive Temp Staging

title: PowerShell Compress-Archive Temp Staging
id: 8e184057-9c55-4cdc-b893-63d65e2dccf8
related:
  - id: 71ff406e-b633-4989-96ec-bc49d825a412
    type: similar
  - id: daf7eb81-35fd-410d-9d7a-657837e602bb
    type: similar
  - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
    type: similar
  - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
    type: derived
status: test
description: This rule identifies PowerShell script block text that uses Compress-Archive to compress files or folders with the output directed into common temporary locations such as $env:TEMP, AppData\Local\Temp, or Windows\Temp. Attackers may compress collected data to make it easier to package and exfiltrate while reducing transfer size. It relies on PowerShell script block logging telemetry to match specific Compress-Archive command patterns and destination paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2021-07-20
modified: 2023-12-18
tags:
  - attack.collection
  - attack.t1074.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Compress-Archive -Path*-DestinationPath $env:TEMP
      - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\
      - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1