TeamPCP Artifact Archive Creation

Brandon Rodriguez@BMRodriguez

•updated Mar 25, 2026•12•0•121

Detects the creation or manipulation of the specific archive file (tpcp.tar.gz) used by TeamPCP to bundle stolen credentials. This rule monitors command line activity, cloud process execution, and file system events for references to 'tpcp.tar.gz'.