Zip A Folder With PowerShell For Staging In Temp

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in suspicious temporary locations often used by malware for exfiltration. Adversaries may compress collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network transfer.