PowerShell Compress-Archive to Suspicious Temp Location

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•15

Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in potentially suspicious locations often used by malware for exfiltration. This activity indicates an adversary might be compressing collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network data transfer.