Suspicious Archive Utility Execution

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•3•0•7

Detects the execution of known archival utilities (7-Zip or WinRAR) with command-line arguments indicative of file staging or compression, commonly associated with the collection and preparation of data for exfiltration.