Evasive ZIP/CAB Payload Reassembly via Copy Command
Detects the command-line pattern of reassembling a ZIP or CAB file from fragmented parts using the 'copy' command. This technique was observed in a campaign where adversaries manually reconstructed payloads on disk to evade detection by splitting them into multiple parts and then reassembling them.
Microsoft Sentinel (KQL)
