Data Staging via Password-Protected Archive Creation (T1560.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the execution of common archival utilities (7zip, WinRAR) with command-line arguments specifying password protection. Attackers often use these utilities to compress and encrypt data prior to exfiltration to evade detection and prevent unauthorized access to sensitive files.