PowerShell Data Staging via Compress-Archive

Adversaries often utilize native administrative tools such as PowerShell to stage collected data prior to unauthorized exfiltration. A common tactic involves identifying sensitive files or directories and compressing them using the Compress-Archive cmdlet. By directing the output of these compression operations to standard temporary locations like %TEMP%, AppData\Local\Temp, or C:\Windows\Temp, attackers attempt to blend in with legitimate system activities or transient application data. This staging process is a critical precursor to exfiltration, as it minimizes the total volume of data, enables the use of archiving formats for easier transport, and can potentially bypass basic inspection mechanisms that monitor for individual file transfers rather than consolidated archives.

Attack Chain

1. An attacker identifies sensitive directories containing user data or configuration files on a compromised host.
2. The attacker executes a PowerShell script, often embedded within a malicious payload or run interactively via a remote shell.
3. The script invokes the Compress-Archive cmdlet to recursively bundle the targeted files into a single archive file (e.g., .zip).
4. The archive is written to a temporary directory such as $env:TEMP or C:\Windows\Temp to avoid immediate detection in user-monitored folders.
5. The attacker may then perform obfuscation, such as renaming the archive extension, to bypass simple file-type filtering.
6. The final archive is staged and prepared for exfiltration to an attacker-controlled C2 server or cloud storage bucket.

Impact

Successful staging enables efficient exfiltration of sensitive organizational data, increasing the risk of data breaches, intellectual property theft, and exposure of PII. While this technique is a component of the collection phase, its prevalence in ransomware and espionage campaigns makes it a high-value indicator of malicious intent when observed in non-administrative contexts.

Recommendation

Prioritize the deployment of script block logging to monitor for suspicious command execution.

• Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture the full command context, including the parameters used with Compress-Archive.
• Implement the provided Sigma rule in your SIEM to trigger alerts when Compress-Archive is directed to sensitive temporary paths.
• Monitor for the creation of archive files in temporary directories, specifically flagging files with high entropy or those created by non-standard parent processes.