LoFP / powershell may used this function to archive data.

Techniques

• T1560

Sample rules

Windows Archive Collected Data via Powershell

• source: splunk
• technicques:
  • T1560

Description

The following analytic detects the use of PowerShell scripts to archive files into a temporary folder. It leverages PowerShell Script Block Logging, specifically monitoring for the Compress-Archive command targeting the Temp directory. This activity is significant as it may indicate an adversary’s attempt to collect and compress data for exfiltration. If confirmed malicious, this behavior could lead to unauthorized data access and exfiltration, posing a severe risk to sensitive information and overall network security.

Detection logic

`powershell` EventCode=4104 ScriptBlockText = "*Compress-Archive*"  ScriptBlockText = "*\\Temp\\*" 
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
| rename Computer as dest 
| rename UserID as user 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_archive_collected_data_via_powershell_filter`