Large Zstandard Archive Created in Temporary or Staging Paths

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•3

Detects the creation or modification of large Zstandard (.zst or .tar.zst) archive files (100MB or larger) within common temporary, data exfiltration, staging, or PeopleSoft-related directories. This activity can indicate an attacker archiving collected data for exfiltration or staging it for further actions.