GOLD ENCOUNTER Pre-Exfiltration Data Staging via Archive Tools in Temp Dirs
Detects suspicious bulk archiving activity or file drops of archive formats in staging directories. The rule monitors for common archival utilities (7zip, WinRAR) or PowerShell's Compress-Archive command being used, or the creation of archive files in suspicious paths (e.g., Temp, AppData, Public). It alerts when high volumes of archives are created, password-protected archives are used, or rapid archival operations are performed.
Splunk (SPL)
