PowerShell Expand-Archive Spawned from Suspicious Parent Process

Duo Tech@duotech

•updated Jun 30, 2026•0•0•1

Detects the execution of PowerShell with the 'Expand-Archive' cmdlet originating from a suspicious or non-standard parent process. This pattern is commonly used by malware loaders, such as Amadey, to unpack second-stage payloads like StealC from downloaded ZIP archives hidden in temporary application folders.