Sensitive File Staging and Archive Creation in User-Writable Directories
Detects the use of common archive utilities (7zip, WinRAR, zip) to interact with files located in suspicious directories commonly used for data staging (AppData, Temp, Users Public). The rule tracks multiple occurrences of these commands by the same user on a host to identify potentially malicious collection and staging activities before exfiltration.
Splunk (SPL)
