PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging

Flags PowerShell scripts compressing data with Compress-Archive into $env:TEMP or Temp folders.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published: 2021-07-20
Updated: 2026-07-31

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1074.001Local Data Staging
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block text that uses Compress-Archive with DestinationPath targeting environment temp locations such as $env:TEMP, AppData\Local\Temp, or \Windows\Temp. Compressing staged data is a common step to make collected files more portable and reduce what needs to be transferred during exfiltration. It relies on Script Block Logging content matching the specific Compress-Archive command patterns and destination paths.

Reporting behind it

Related detections8 linkedT1074.001 — drag to rearrange

Malicious Empyrean Stealer Staging Files in AppData (via file_event)

TerraStealerV2 Data Staging in Bay0NsQIzx Package Directory (via file_event)

Suspicious C2Looper Shell Output Artifact File Creation (via file_event)

Malicious Kimsuky Troll Stealer Collected Data Staging Files with gte1 Extension (via file_event)

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

PowerShell Classic Compress-Archive staging in TEMP or Temp directories

PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths

Windows PowerShell module usage: Compress-Archive to store archives in Temp locations

PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging

Pivot detection · T1074.001 · 8 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-compress-archive-temp-staging-b7a3c9a3

title: "PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging"
id: 8e184057-9c55-4cdc-b893-63d65e2dccf8
related:
  - id: 71ff406e-b633-4989-96ec-bc49d825a412
    type: similar
  - id: daf7eb81-35fd-410d-9d7a-657837e602bb
    type: similar
  - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
    type: similar
  - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
    type: derived
status: test
description: This rule flags PowerShell script block text that uses Compress-Archive with DestinationPath targeting environment temp locations such as $env:TEMP, AppData\Local\Temp, or \Windows\Temp. Compressing staged data is a common step to make collected files more portable and reduce what needs to be transferred during exfiltration. It relies on Script Block Logging content matching the specific Compress-Archive command patterns and destination paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2021-07-20
modified: 2023-12-18
tags:
  - attack.collection
  - attack.t1074.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Compress-Archive -Path*-DestinationPath $env:TEMP
      - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\
      - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL