PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging
Flags PowerShell scripts compressing data with Compress-Archive into $env:TEMP or Temp folders.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-07-20
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block text that uses Compress-Archive with DestinationPath targeting environment temp locations such as $env:TEMP, AppData\Local\Temp, or \Windows\Temp. Compressing staged data is a common step to make collected files more portable and reduce what needs to be transferred during exfiltration. It relies on Script Block Logging content matching the specific Compress-Archive command patterns and destination paths.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
- cisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging"
id: 8e184057-9c55-4cdc-b893-63d65e2dccf8
related:
- id: 71ff406e-b633-4989-96ec-bc49d825a412
type: similar
- id: daf7eb81-35fd-410d-9d7a-657837e602bb
type: similar
- id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
type: similar
- id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
type: derived
status: test
description: This rule flags PowerShell script block text that uses Compress-Archive with DestinationPath targeting environment temp locations such as $env:TEMP, AppData\Local\Temp, or \Windows\Temp. Compressing staged data is a common step to make collected files more portable and reduce what needs to be transferred during exfiltration. It relies on Script Block Logging content matching the specific Compress-Archive command patterns and destination paths.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2021-07-20
modified: 2023-12-18
tags:
- attack.collection
- attack.t1074.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- Compress-Archive -Path*-DestinationPath $env:TEMP
- Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\
- Compress-Archive -Path*-DestinationPath*:\Windows\Temp\
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1