Double Extortion Pre-Stage Bulk Password-Protected Archive Creation T1560.001

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects the execution of common archival utilities (7-Zip, WinRAR, RAR, ZIP) with parameters indicative of password-protected archive creation. It specifically flags instances where a user account, with no recorded prior history of running these utilities in the last 30 days, creates a large archive (exceeding 1GB) spanning multiple directories. This pattern is commonly used for data staging and preparation prior to exfiltration.