Large Archive File Creation by Archiving Tools
Bulk staging prior to exfiltration commonly produces large archives written by archiving utilities or PowerShell. A size threshold (≥100 MB) cuts noise from small routine archives.
Microsoft Sentinel (KQL)

