Hidden-Window PowerShell Compress-Archive Staging TOKYOCORE Data

Duo Tech@duotech

•updated Jul 27, 2026•0•0•9

Detects a PowerShell process executing with a hidden window style while using the Compress-Archive cmdlet to target the tokyocore_data directory or archive, a behavior consistent with TOKYOCORE ransomware data staging for exfiltration.