Staging of Certificate Files via Archiving Utility
Detects the use of common command-line archiving utilities to compress files with extensions commonly associated with digital certificates and private keys. This behavior can indicate the staging of stolen certificates for exfiltration.
Sigma
