{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/staging/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["data-collection","powershell","staging"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries often utilize native administrative tools such as PowerShell to stage collected data prior to unauthorized exfiltration. A common tactic involves identifying sensitive files or directories and compressing them using the Compress-Archive cmdlet. By directing the output of these compression operations to standard temporary locations like %TEMP%, AppData\\Local\\Temp, or C:\\Windows\\Temp, attackers attempt to blend in with legitimate system activities or transient application data. This staging process is a critical precursor to exfiltration, as it minimizes the total volume of data, enables the use of archiving formats for easier transport, and can potentially bypass basic inspection mechanisms that monitor for individual file transfers rather than consolidated archives.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies sensitive directories containing user data or configuration files on a compromised host.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a PowerShell script, often embedded within a malicious payload or run interactively via a remote shell.\u003c/li\u003e\n\u003cli\u003eThe script invokes the Compress-Archive cmdlet to recursively bundle the targeted files into a single archive file (e.g., .zip).\u003c/li\u003e\n\u003cli\u003eThe archive is written to a temporary directory such as $env:TEMP or C:\\Windows\\Temp to avoid immediate detection in user-monitored folders.\u003c/li\u003e\n\u003cli\u003eThe attacker may then perform obfuscation, such as renaming the archive extension, to bypass simple file-type filtering.\u003c/li\u003e\n\u003cli\u003eThe final archive is staged and prepared for exfiltration to an attacker-controlled C2 server or cloud storage bucket.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful staging enables efficient exfiltration of sensitive organizational data, increasing the risk of data breaches, intellectual property theft, and exposure of PII. While this technique is a component of the collection phase, its prevalence in ransomware and espionage campaigns makes it a high-value indicator of malicious intent when observed in non-administrative contexts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the deployment of script block logging to monitor for suspicious command execution.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture the full command context, including the parameters used with Compress-Archive.\u003c/li\u003e\n\u003cli\u003eImplement the provided Sigma rule in your SIEM to trigger alerts when Compress-Archive is directed to sensitive temporary paths.\u003c/li\u003e\n\u003cli\u003eMonitor for the creation of archive files in temporary directories, specifically flagging files with high entropy or those created by non-standard parent processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-03T13:43:24Z","date_published":"2026-09-03T13:43:24Z","id":"https://feed.craftedsignal.io/briefs/2026-09-zip-staging-powershell/","summary":"Adversaries frequently use the PowerShell Compress-Archive cmdlet to stage sensitive data for exfiltration within common temporary directories, a technique used to consolidate and obfuscate collected information.","title":"PowerShell Data Staging via Compress-Archive","url":"https://feed.craftedsignal.io/briefs/2026-09-zip-staging-powershell/"}],"language":"en","title":"CraftedSignal Threat Feed - Staging","version":"https://jsonfeed.org/version/1.1"}