Detect archiving utilities run with an archive-creating verb

Siemphony@siemphonymediumT1560.001verified in lab

Detects the process-creation half of MITRE's AN0831: an archiving utility invoked in a way that creates or encrypts an archive. The gate is the utility plus a create verb or flag, and never an archive extension on its own — 7-Zip and WinRAR append the extension themselves, so `7z.exe a stage C:\loot` writes stage.7z with no `.7z` on the command line, while `7z.exe x report.zip` and a user double-clicking a download into 7zFM.exe both carry one. Archive extraction, listing and testing are therefore deliberately out of scope: on a workstation fleet they outnumber archive creation by orders of magnitude and none of them is this technique. MITRE's SuspiciousExtensions knob belongs to the file-creation half of the analytic, not to this one; makecab and diantz are the exception, and are carried by their own switches (` /d `, ` /f `, `.ddf`) because they take no verb. The utility is matched on Image and on OriginalFileName so a renamed copy still lands, but OriginalFileName exists only on Sysmon EventID 1 — under Security 4688 that arm is always empty and only the Image path applies. The tar terms cover both the short and the GNU long options, since `tar.exe --create --file=loot.tar` contains none of the short ones; ` -c` is a two-character term and will also catch a WinRAR `-c-` or `-cfg-` switch on a non-creating command. certutil gets its own selection paired only with the encode switches, so `certutil -urlcache -split -f http://host/payload.zip`, which is Ingress Tool Transfer and not archiving, does not match by accident. Compress-Archive is matched on the command line alone because it is a cmdlet with no binary of its own. Security 4688 is off in a default install and needs Audit Process Creation, and its CommandLine field needs the separate Include command line in process creation events policy; without both this rule returns nothing because nothing is being collected. The file-write half of the analytic, and MITRE's FileSizeThresholdMB knob with it, has no process-creation equivalent, so a one-file compression looks the same here as a staged collection. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0298, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((((FolderPath endswith "\\7z.exe" or FolderPath endswith "\\7za.exe" or FolderPath endswith "\\7zg.exe" or FolderPath endswith "\\7zr.exe" or FolderPath endswith "\\7zfm.exe" or FolderPath endswith "\\rar.exe" or FolderPath endswith "\\winrar.exe" or FolderPath endswith "\\wzzip.exe" or FolderPath endswith "\\winzip32.exe" or FolderPath endswith "\\winzip64.exe" or FolderPath endswith "\\makecab.exe" or FolderPath endswith "\\diantz.exe" or FolderPath endswith "\\tar.exe") or (ProcessVersionInfoOriginalFileName =~ "7z.exe" or ProcessVersionInfoOriginalFileName =~ "7za.exe" or ProcessVersionInfoOriginalFileName =~ "Rar.exe" or ProcessVersionInfoOriginalFileName =~ "WinRAR.exe" or ProcessVersionInfoOriginalFileName =~ "tar.exe" or ProcessVersionInfoOriginalFileName =~ "makecab.exe")) and (ProcessCommandLine contains " a " or ProcessCommandLine contains " u " or ProcessCommandLine contains " -hp" or ProcessCommandLine contains " -mhe" or ProcessCommandLine contains " -r0" or ProcessCommandLine contains " -t7z" or ProcessCommandLine contains " -c" or ProcessCommandLine contains " --create" or ProcessCommandLine contains " --xz" or ProcessCommandLine contains " --gzip" or ProcessCommandLine contains " /d " or ProcessCommandLine contains " /f " or ProcessCommandLine contains ".ddf")) or (FolderPath endswith "\\certutil.exe" and (ProcessCommandLine contains "-encode" or ProcessCommandLine contains "/encode" or ProcessCommandLine contains "-encodehex"))) or ProcessCommandLine contains "Compress-Archive")

Splunk · SPL

Run this as a search.

index=* (((((Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zg.exe" OR Image="*\\7zr.exe" OR Image="*\\7zfm.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe" OR Image="*\\wzzip.exe" OR Image="*\\winzip32.exe" OR Image="*\\winzip64.exe" OR Image="*\\makecab.exe" OR Image="*\\diantz.exe" OR Image="*\\tar.exe") OR (OriginalFileName="7z.exe" OR OriginalFileName="7za.exe" OR OriginalFileName="Rar.exe" OR OriginalFileName="WinRAR.exe" OR OriginalFileName="tar.exe" OR OriginalFileName="makecab.exe")) AND (CommandLine="* a *" OR CommandLine="* u *" OR CommandLine="* -hp*" OR CommandLine="* -mhe*" OR CommandLine="* -r0*" OR CommandLine="* -t7z*" OR CommandLine="* -c*" OR CommandLine="* --create*" OR CommandLine="* --xz*" OR CommandLine="* --gzip*" OR CommandLine="* /d *" OR CommandLine="* /f *" OR CommandLine="*.ddf*")) OR (Image="*\\certutil.exe" AND (CommandLine="*-encode*" OR CommandLine="*/encode*" OR CommandLine="*-encodehex*"))) OR CommandLine="*Compress-Archive*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((((TO_LOWER(process.executable) LIKE "*\\\\7z.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7za.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7zg.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7zr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7zfm.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winrar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wzzip.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winzip32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\winzip64.exe" OR TO_LOWER(process.executable) LIKE "*\\\\makecab.exe" OR TO_LOWER(process.executable) LIKE "*\\\\diantz.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tar.exe") OR (TO_LOWER(process.pe.original_file_name) == "7z.exe" OR TO_LOWER(process.pe.original_file_name) == "7za.exe" OR TO_LOWER(process.pe.original_file_name) == "rar.exe" OR TO_LOWER(process.pe.original_file_name) == "winrar.exe" OR TO_LOWER(process.pe.original_file_name) == "tar.exe" OR TO_LOWER(process.pe.original_file_name) == "makecab.exe")) AND (TO_LOWER(process.command_line) LIKE "* a *" OR TO_LOWER(process.command_line) LIKE "* u *" OR TO_LOWER(process.command_line) LIKE "* -hp*" OR TO_LOWER(process.command_line) LIKE "* -mhe*" OR TO_LOWER(process.command_line) LIKE "* -r0*" OR TO_LOWER(process.command_line) LIKE "* -t7z*" OR TO_LOWER(process.command_line) LIKE "* -c*" OR TO_LOWER(process.command_line) LIKE "* --create*" OR TO_LOWER(process.command_line) LIKE "* --xz*" OR TO_LOWER(process.command_line) LIKE "* --gzip*" OR TO_LOWER(process.command_line) LIKE "* /d *" OR TO_LOWER(process.command_line) LIKE "* /f *" OR TO_LOWER(process.command_line) LIKE "*.ddf*")) OR (TO_LOWER(process.executable) LIKE "*\\\\certutil.exe" AND (TO_LOWER(process.command_line) LIKE "*-encode*" OR TO_LOWER(process.command_line) LIKE "*/encode*" OR TO_LOWER(process.command_line) LIKE "*-encodehex*"))) OR TO_LOWER(process.command_line) LIKE "*compress-archive*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 4 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\7z\.exe$|\\7za\.exe$|\\7zg\.exe$|\\7zr\.exe$|\\7zfm\.exe$|\\rar\.exe$|\\winrar\.exe$|\\wzzip\.exe$|\\winzip32\.exe$|\\winzip64\.exe$|\\makecab\.exe$|\\diantz\.exe$|\\tar\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( a | u | -hp| -mhe| -r0| -t7z| -c| --create| --xz| --gzip| /d | /f |\.ddf)</field>    <description>Detect archiving utilities run with an archive-creating verb (1/4)</description>    <mitre>      <id>T1560.001</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="OriginalFileName" type="pcre2">(?i)(^7z\.exe$|^7za\.exe$|^Rar\.exe$|^WinRAR\.exe$|^tar\.exe$|^makecab\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( a | u | -hp| -mhe| -r0| -t7z| -c| --create| --xz| --gzip| /d | /f |\.ddf)</field>    <description>Detect archiving utilities run with an archive-creating verb (2/4)</description>    <mitre>      <id>T1560.001</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\certutil\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(-encode|/encode|-encodehex)</field>    <description>Detect archiving utilities run with an archive-creating verb (3/4)</description>    <mitre>      <id>T1560.001</id>    </mitre>  </rule>   <rule id="100003" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)Compress-Archive</field>    <description>Detect archiving utilities run with an archive-creating verb (4/4)</description>    <mitre>      <id>T1560.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 197e0b0a-d601-4936-b7c3-8dcee303199e

ATT&CKT1560.001

T1560.001Archive via Utility

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

Before data leaves a network it usually gets packed first. This rule matches a process-creation event where both an archiving utility is the running image and its command line references an archive container or an encoding switch. Neither half is interesting alone. Together they are the process-creation leg of MITRE's AN0831.

02 · Telemetry you need

process_creation / windows with the command line captured. AN0831's
A field-mapping caveat worth internalising: the rule uses Image, Sysmon
AN0831 also names Sysmon EventID 11 (File Creation) and EventID 7 (Module

03 · How the logic works

Two selections, ANDed:

Why the AND is the entire rule. Either half alone is unusable. certutil.exe runs constantly for certificate operations; .zip appears in command lines all day. Requiring both in the same event converts two high-volume facts into a statement about intent. And "in the same event" is a hard constraint, not phrasing: Sigma matches one event at a time. It cannot say "7z.exe ran on this host and an archive appeared shortly after" — that is a correlation, and precisely the half of AN0831 this rule drops. endswith on Image anchors \7z.exe on the path separator and rejects not7z.exe; contains on CommandLine is required because the extension is a fragment sitting anywhere in the arguments. *Why `-encode` and `/encode` are in an archive rule. They are certutil's base64 switch and compress nothing. They are here because MITRE's technique description explicitly names certutil base64-encoding collected data as T1560.001 — the tactic is "package data for transport", and encoding qualifies. Listing both dash forms literally is equivalent to Sigma's `windash` modifier and renders the same in four backends. The knob that could not be implemented. MITRE's `FileSizeThresholdMB` exists to drop benign small compressions. Process creation carries no file size; that field lives only on the EventID 11 leg. The rule names the gap in its description rather than pretending to satisfy it — a knob MITRE lists is not automatically a knob your logsource gives you, and saying which ones you dropped beats quietly omitting them. The weakest line, called out by its own author. `xcopy.exe` + `.zip` matches a plain copy of an existing archive. Nothing is compressed; the extension merely appears in a path. That is the cost of a substring as an intent proxy — it cannot distinguish creating an archive from naming* one.

04 · Common false positives

Build and packaging automation, where makecab.exe and 7z.exe produce
Backup, log-collection and vendor diagnostic collectors zipping a directory
xcopy.exe during file-server migrations and profile copies, per above.
Anything that passes an archive path as an argument without acting on it.

05 · Detection maturity

tier_1: . Authored from MITRE's scaffold — MITRE ships no query logic for any technique — and never executed against a log line. It compiles and renders in four backends, and none of that is evidence it works.
tier_2: run it read-only against your own history, see which of the ten utilities actually appear, delete the ones that never do, and build the parent-scoped `ProcessAllowlist`.
tier_3: ** join it to AN0831's Sysmon EventID 11 archive-write leg within a time window, which finally lets you apply FileSizeThresholdMB and alert on archives that were created rather than merely mentioned.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's `ProcessAllowlist` knob is where build tooling goes — but scope
MITRE's `SuspiciousExtensions` knob is the severity dial. If .zip
Drop xcopy.exe if migrations are routine — the term most likely to be all
Add the context process creation has and file creation does not: User,

Declared by the author

Software distribution and patching on every managed endpoint, not only on build hosts. Application installs, package managers and vendor updaters routinely shell out to 7z.exe, tar.exe or makecab.exe against a staged payload, and this is the rule's top talker fleet-wide. MITRE's ProcessAllowlist knob is the right place for it, scoped to the parent process rather than to the utility name, since the utility name is the same one an operator would use.
Backup, log-collection and support workflows that archive a directory before upload — helpdesk scripts, vendor diagnostic collectors, CI artefact packaging. Compress-Archive has no utility gate in this rule at all, so any script that zips anything matches on that arm alone.
Golden-image and release pipelines where makecab.exe, diantz.exe and tar.exe produce output on every run. The makecab terms are switch-shaped rather than verb-shaped, so a directive-file build fires on ' /f ' or '.ddf' with nothing else needed.
A user compressing files interactively through the 7-Zip or WinRAR shell menu, which launches 7zG.exe or WinRAR.exe with the same ' a ' verb an operator would use, including the password-protected form that trips ' -hp' when someone protects an archive before emailing it.

Noise checkfires on 1 of 30

Fires on 1 of 30 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

pc-7zip-archive-backup
A nightly job archiving a directory before upload. Archive-then-exfiltrate is a technique; archive-then-back-up is a Tuesday.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Archive collected data
passed
Siemphony IR · 3 Sept 2026
5 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1560.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/197e0b0a-d601-4936-b7c3-8dcee303199e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect archiving utilities run with an archive-creating verb

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it