Suspicious Archive File Creation

Ankit Mehta@Secvyn

•updated Jun 5, 2026•1•0•4

Detects the creation of archive files (zip, rar, 7z, tar.gz) by processes other than common archiving utilities. This could indicate data staging or preparation for exfiltration by an adversary.