In-Memory Archive Created via .NET Compression Library

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects the creation of in-memory archives using the .NET Compression Library by inspecting HTTP client-bound data for the presence of both "System.IO.Compression" and "ZipArchive" strings. This combination suggests that a .NET application is creating a ZIP archive in memory, which could be indicative of data staging or exfiltration activities.