7-Zip Data Archiving Targeting User Directories (T1560.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the use of 7-Zip (7z.exe or 7zip.exe) to archive files within common user directories (Desktop, Documents, Users, AppData). This activity is often associated with staging sensitive data prior to exfiltration.