Compression library loaded by a script host or LOLBin

Siemphony@siemphonymediumT1560.002unverified

Takes the module-load leg of MITRE's AN0747 — a compression or archiving library mapped into a script interpreter or a signed LOLBin host — which is what separates archiving via library from archiving via utility, and therefore what separates this rule from the published T1560.001 rule: that one matches process_creation on an archiver binary and a verb, this one never looks at a command line and never matches an archiver at all. The library list is authored here rather than taken from MITRE, whose MonitoredLibraries and LibraryAllowlist knobs name the tuning point but no values, and it includes the Python extension modules on purpose, because CPython compiles zlib into the interpreter's own DLL so the most common Python archiving path — zipfile over zlib — produces no separate module load and is invisible here, while bz2 and lzma still surface as _bz2.pyd and _lzma.pyd. A module load says a library was mapped, not what it was used for, so decompression and archive extraction are indistinguishable from archive creation on this event, and the file-creation leg of the analytic that would settle it is a separate log source. Sysmon EventID 7 is off in the configuration Sysmon ships and is filtered down hard in the common community configurations, so without an explicit include for these DLLs the rule returns zero rows regardless of what ran. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0268, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where ((InitiatingProcessFolderPath endswith "\\powershell.exe" or InitiatingProcessFolderPath endswith "\\pwsh.exe" or InitiatingProcessFolderPath endswith "\\python.exe" or InitiatingProcessFolderPath endswith "\\pythonw.exe" or InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe" or InitiatingProcessFolderPath endswith "\\mshta.exe" or InitiatingProcessFolderPath endswith "\\rundll32.exe" or InitiatingProcessFolderPath endswith "\\regsvr32.exe") and (FolderPath endswith "\\zlib1.dll" or FolderPath endswith "\\zlibwapi.dll" or FolderPath endswith "\\libzip.dll" or FolderPath endswith "\\libbz2.dll" or FolderPath endswith "\\bz2.dll" or FolderPath endswith "\\7z.dll" or FolderPath endswith "\\7za.dll" or FolderPath endswith "\\Ionic.Zip.dll" or FolderPath endswith "\\SharpCompress.dll" or FolderPath endswith "\\System.IO.Compression.dll" or FolderPath endswith "\\System.IO.Compression.Native.dll" or FolderPath endswith "\\clrcompression.dll" or FolderPath endswith "\\_bz2.pyd" or FolderPath endswith "\\_lzma.pyd"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\python.exe" OR Image="*\\pythonw.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\regsvr32.exe") AND (ImageLoaded="*\\zlib1.dll" OR ImageLoaded="*\\zlibwapi.dll" OR ImageLoaded="*\\libzip.dll" OR ImageLoaded="*\\libbz2.dll" OR ImageLoaded="*\\bz2.dll" OR ImageLoaded="*\\7z.dll" OR ImageLoaded="*\\7za.dll" OR ImageLoaded="*\\Ionic.Zip.dll" OR ImageLoaded="*\\SharpCompress.dll" OR ImageLoaded="*\\System.IO.Compression.dll" OR ImageLoaded="*\\System.IO.Compression.Native.dll" OR ImageLoaded="*\\clrcompression.dll" OR ImageLoaded="*\\_bz2.pyd" OR ImageLoaded="*\\_lzma.pyd"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\python.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pythonw.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.executable) LIKE "*\\\\regsvr32.exe") AND (TO_LOWER(file.path) LIKE "*\\\\zlib1.dll" OR TO_LOWER(file.path) LIKE "*\\\\zlibwapi.dll" OR TO_LOWER(file.path) LIKE "*\\\\libzip.dll" OR TO_LOWER(file.path) LIKE "*\\\\libbz2.dll" OR TO_LOWER(file.path) LIKE "*\\\\bz2.dll" OR TO_LOWER(file.path) LIKE "*\\\\7z.dll" OR TO_LOWER(file.path) LIKE "*\\\\7za.dll" OR TO_LOWER(file.path) LIKE "*\\\\ionic.zip.dll" OR TO_LOWER(file.path) LIKE "*\\\\sharpcompress.dll" OR TO_LOWER(file.path) LIKE "*\\\\system.io.compression.dll" OR TO_LOWER(file.path) LIKE "*\\\\system.io.compression.native.dll" OR TO_LOWER(file.path) LIKE "*\\\\clrcompression.dll" OR TO_LOWER(file.path) LIKE "*\\\\_bz2.pyd" OR TO_LOWER(file.path) LIKE "*\\\\_lzma.pyd"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\python\.exe$|\\pythonw\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\regsvr32\.exe$)</field>    <field name="ImageLoaded" type="pcre2">(?i)(\\zlib1\.dll$|\\zlibwapi\.dll$|\\libzip\.dll$|\\libbz2\.dll$|\\bz2\.dll$|\\7z\.dll$|\\7za\.dll$|\\Ionic\.Zip\.dll$|\\SharpCompress\.dll$|\\System\.IO\.Compression\.dll$|\\System\.IO\.Compression\.Native\.dll$|\\clrcompression\.dll$|\\_bz2\.pyd$|\\_lzma\.pyd$)</field>    <description>Compression library loaded by a script host or LOLBin</description>    <mitre>      <id>T1560.002</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e61acb1b-d5b1-46d9-a759-c4d20e1f8d69

ATT&CKT1560.002

T1560.002Archive via Library

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

AN0747 correlates process execution (Python, PowerShell, or a custom .NET binary) with a compression-library module load and a subsequent archive file creation. This rule implements only the middle leg: a Sysmon image_load event where selection_host (Image|endswith one of nine script hosts and LOLBins — powershell.exe, pwsh.exe, python.exe, pythonw.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, regsvr32.exe) is ANDed with selection_library (ImageLoaded|endswith one of fourteen compression assemblies — zlib1.dll, libbz2.dll, 7z.dll, System.IO.Compression.dll, _bz2.pyd, _lzma.pyd, and others). A hit says a compression library was mapped into one of these processes; it never inspects a command line, and it never matches an archiver binary directly — that is the published T1560.001 rule, which shares no field or event with this one.

02 · Telemetry you need

Sysmon EventID 7, category: image_load / product: windows, copied verbatim from AN0747. Module load is off in Sysmon's shipped configuration and filtered hard in common community configs; without an explicit include for these DLLs, the rule returns zero rows regardless of what ran. Sentinel has no table modelled for this logsource and refuses; Splunk, Elastic and Wazuh render it.

03 · How the logic works

The two selections are AND-joined, so a hit needs a listed host process to load a listed library — no timing or ordering is enforced. The library list mixes native DLLs (zlib1.dll, libzip.dll, 7z.dll/7za.dll), .NET assemblies (Ionic.Zip.dll, SharpCompress.dll, System.IO.Compression.dll, clrcompression.dll), and two Python extension modules (_bz2.pyd, _lzma.pyd). MITRE's LibraryAllowlist and MonitoredLibraries knobs name the tuning point; the specific fourteen values are the rule author's own choice, assembled from public reporting, not supplied by MITRE. The description is explicit about a real blind spot: CPython on Windows compiles zlib directly into the interpreter's own DLL, so zipfile over zlib — the most common Python archiving path — produces no separate module load and is invisible to this rule. Only bz2 and lzma usage surfaces, as _bz2.pyd and _lzma.pyd.

04 · Common false positives

The reviewer's central finding is calibration: false-positive entry 1 (Compress-Archive/Expand-Archive in deployment and backup scripts) is called the rule's highest-volume match by a wide margin, and entry 3 (any gzip- or deflate-encoded HTTP response through Invoke-WebRequest) is continuous background traffic on a managed estate. The contract sets level from the top false-positive entry, and a rule whose loudest match is routine automation is not medium — the reviewer's suggested fix is low, or informational until LibraryAllowlist is populated per environment.
Two coverage gaps compound the noise-versus-blind-spot trade. python.exe in the host list misses python3.exe and the version-suffixed python3.11.exe/python3.12.exe the Microsoft Store package and several venv layouts use — the version-suffix trap this corpus tracks elsewhere, here silently narrowing the Python arm. And System.IO.Compression.FileSystem.dll — the assembly PowerShell 5.1's Compress-Archive and [System.IO.Compression.ZipFile] actually resolve — is absent from a library list built for exactly this technique, though the rule still fires via clrcompression.dll. The reviewer's missed false positive: routine PowerShell remoting and module import (WinRM payload compression, any web-touching module such as Az, AWS, or PSResourceGet) pulls the same libraries into powershell.exe without ever creating an archive.

05 · Detection maturity

tier_1: . UNVERIFIED, derived from a MITRE scaffold with no query logic, never run against a log line.
tier_2: run read-only, rank hits by `Image` and `ImageLoaded`, and expect `Compress-Archive`/`Expand-Archive` automation and gzip-bearing web requests to dominate — use that ranking to populate `LibraryAllowlist` and set a level the evidence actually supports.
tier_3: ** chain to the file_event leg under MITRE's TimeWindow so an alert requires a resulting archive, not just a library mapped into memory, and add a Python zipfile/zlib signal on a different event to cover the built-in blind spot this rule cannot see.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Reconsider the level before deployment — drop to low or informational
Add python3.exe and the version-suffixed binaries, or match
Add System.IO.Compression.FileSystem.dll to the library list.
MITRE's SuspiciousExtensions and TimeWindow knobs both require the

Declared by the author

Compress-Archive and Expand-Archive in software deployment, log collection and backup scripts, which load the compression assemblies on every call. In any estate that automates with PowerShell this is the rule's highest-volume match by a wide margin, and it is why the level is medium rather than high.
PowerShell package management installing or updating a module, which unpacks a .nupkg through the same assemblies on every install, on every host that pulls modules from a gallery or an internal feed.
Invoke-WebRequest and Invoke-RestMethod against any endpoint that returns gzip or deflate encoded content, which pulls in the native compression library even though nothing is ever written to disk.
Python build, packaging and data work on developer and CI hosts — wheel creation, test fixtures, reading a .bz2 or .xz dataset — which loads _bz2.pyd and _lzma.pyd as a matter of routine.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1560.002, evaluated against their image_load events.

Share this rule

/u/siemphony/e61acb1b-d5b1-46d9-a759-c4d20e1f8d69

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Compression library loaded by a script host or LOLBin

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it