PowerShell Expand-Archive Command Usage

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the use of the 'Expand-Archive' command within PowerShell logs. Adversaries may use this command to decompress files, potentially as part of a larger attack chain involving unpacking malicious payloads or tools.