Archiving of ProgramData AnyDesk directory via WinRAR or PowerShell Compress
Detects the archiving of the ProgramData AnyDesk directory using WinRAR/RAR with header encryption or the PowerShell Compress-Archive function, which indicates configuration staging for potential exfiltration.
Sigma
