Windows Bulk Document Collection and Zip Staging

Danny Y@zendannyy

•updated Jun 20, 2026•0•0•1

Hunting rule: correlate with additional signals before alerting. Detects recursive collection of office documents into a single archive, common pre-exfil staging.