Archive Utility Staging of Sensitive Data via 7z, WinRAR, or Zip (T1560.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects the execution of known archive utilities (e.g., 7-Zip, WinRAR) when interacting with sensitive user or system directories. This behavior is often indicative of data staging prior to potential exfiltration, especially when the originating process is not a recognized installer or backup application.