Zip File Creation Detected

Shadows VMB@Vemorian_Mort

•updated Aug 26, 2026•4•0•11

This rule detects when a .zip archive file is created on a host. The creation of archive files can be a precursor to data exfiltration or a method for adversaries to bundle malicious tools for movement.