huntrule

PowerShell Decompress via Expand-Archive

Alerts on PowerShell usage of Expand-Archive, a common decompression step attackers may use to unpack files.

FreeReviewedSigma · Informational · v2
Product
windows
Category
ps_module
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published
2020-05-02
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches PowerShell script module telemetry where the command payload contains the string "Expand-Archive". Adversaries can use archive extraction to unpack files during stealthy staging and follow-on execution. It relies on Windows PowerShell module logging that captures the executed payload content and supports substring matching for the target cmdlet name.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange
Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)
Hidden PowerShell Archive Extraction via ExtractToDirectory
Malicious Shell Payload Piped from curl to zsh
CastleLoader ClickFix PowerShell Hex Decode and Re-Execution
Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32
Suspicious tar Extraction of Staged Archive to Temp (via process_creation)
Malicious Multi Layer Base64 Decoded Payload Execution via Bash (via process_creation)
Malicious Certutil Decode of Encoded Web Shell to ASPX (via process_creation)
Obfuscated File Decoding via Certutil (via process_creation)
PowerShell Decompress via Expand-Archive
Pivot detection · T1140 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.