Suspicious High Volume File Compression Activity

Ankit Mehta@Secvyn

•updated Jun 30, 2026•4•0•5

This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.