Data Exfil - Automated Staging Archive Generation (T1560.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•6

Detects archiving utilities (WinRAR, 7z, zip) executing via command line to recursively compress sensitive user directories (Desktop, Documents, Downloads) into staging folders, which is a common technique for data exfiltration.