Data Staging via RAR/7-Zip Archive Creation in User Profile Dirs (T1560.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•4

Detects the use of common archive utilities (7-Zip, WinRAR) to perform file archiving operations within sensitive user-profile directories (Desktop, Documents, Downloads, etc.). This pattern is often used by adversaries to stage or bundle sensitive data prior to exfiltration.