Threat Hunt: Suspicious Archive File Creation in Temporary Folders before data Exfiltration

Awais Munir@iawais

•updated Jul 16, 2025•4•2•30

This query detects the creation of archive files (ZIP, 7z, RAR) in common temporary or publicly writable directories (C:\Users\Public\, C:\ProgramData\, C:\Windows\Temp, C:\PerfLogs). The files are written by processes commonly abused in attacks, such as powershell.exe, cmd.exe, 7z.exe, winrar.exe, or explorer.exe.