Argamal RAT Compress-Archive data collection prior to exfiltration

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects the execution of PowerShell with the Compress-Archive cmdlet where the process originates from user-writable directories (AppData\Local or AppData\Roaming). This behavior is often associated with the staging of data for exfiltration or the compression of unauthorized tools or logs in a user context.