huntrule

PowerShell Decompress via Expand-Archive

Alerts on PowerShell usage of Expand-Archive, a common decompression step attackers may use to unpack files.

FreeReviewedSigma · Informational · v2
Product
windows
Category
ps_module
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published
2020-05-02
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches PowerShell script module telemetry where the command payload contains the string "Expand-Archive". Adversaries can use archive extraction to unpack files during stealthy staging and follow-on execution. It relies on Windows PowerShell module logging that captures the executed payload content and supports substring matching for the target cmdlet name.

Reporting behind it

Related detections9 linkedT1140 — drag to rearrange
Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell
Suspicious lwp-download Retrieval of Remote File Masquerading as Image via 8220 Gang
Malicious PolarEdge QNAP Backdoor Dropper Script in Temp (via file_event)
Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr
Suspicious Python Inline Deobfuscation and Execution One-Liner
Suspicious Base64 Decoded Payload Piped to Shell on Linux
Suspicious Remote File Download via certutil URLCache (via process_creation)
Malicious certutil Decodehex Payload Reconstruction by DarkGate
Suspicious StrelaStealer Base64 Payload Decode via Certutil (via process_creation)
PowerShell Decompress via Expand-Archive
Pivot detection · T1140 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.