Bulk File Staging via Archive Creation in Writable Directories (T1560.001 / T1074)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.