Archive staging
Detects data being collected into an archive prior to exfiltration — password-protected or maximum-compression RAR / 7-Zip / WinRAR archives, or…
What it detects
Detects data being collected into an archive prior to exfiltration — password-protected or maximum-compression RAR / 7-Zip / WinRAR archives, or PowerShell Compress-Archive of a user document tree. Staging everything into one (often encrypted) archive is a common pre-exfiltration step in both ransomware double-extortion and insider theft.
MITRE ATT&CK mapping
False positives and triage
Backup and packaging workflows also create archives. Password-protected (-hp / -p), maximum-compression (-mx=9), or recursive archives of document/user trees written to a temp/public path are higher-signal. Judge by what is archived and where it goes next (often followed by a cloud upload or a copy to removable media).
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 55%. Source: rules/windows/archive_staging.yaml, licensed under the Apache License 2.0.
id: windows.collection.archive_staging
version: 1.0.0
status: experimental
severity: medium
confidence: 0.55
platforms: [windows]
mitre_techniques: [T1560.001, T1074.001]
description: |
Detects data being collected into an archive prior to exfiltration — password-protected
or maximum-compression RAR / 7-Zip / WinRAR archives, or PowerShell Compress-Archive of a
user document tree. Staging everything into one (often encrypted) archive is a common
pre-exfiltration step in both ransomware double-extortion and insider theft.
match:
event_category_any: [process, script]
command_line_contains_any:
- "rar.exe a "
- "rar a -"
- " -hp"
- "7z.exe a "
- "7za a "
- "7z a -p"
- "-mx=9"
- "compress-archive"
false_positive_guidance: |
Backup and packaging workflows also create archives. Password-protected (-hp / -p),
maximum-compression (-mx=9), or recursive archives of document/user trees written to a
temp/public path are higher-signal. Judge by what is archived and where it goes next
(often followed by a cloud upload or a copy to removable media).
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.