Detect this behaviour by watching for archive creation tools, password-protected file generation, and unusual compression activity near sensitive directories or large outbound transfers. Correlate process execution, file creation, and network activity to spot staging for exfiltration. Focus on endpoints handling sensitive data, and alert when archives are created shortly before external upload or removable-media access.
How Windows compression becomes an exfiltration signal
On Windows, staged exfiltration often leaves a visible pattern before data leaves the host: archives are created, sometimes with passwords, near the source of sensitive files and then moved out through a network channel or to removable media. The detection task is to recognize the combination of process behavior, file activity, and outbound transfer timing rather than any single event in isolation.
That matters because compression alone is normal. The signal strengthens when the archive is created in or near sensitive directories, when the archive name or extension looks like a staging artifact, or when the same process tree soon initiates upload, sync, or copy activity. Treat the workflow as a chain: collection, packaging, then egress. If you only alert on one link in the chain, you will miss most real staging behavior.
For defenders building a broader exfiltration view, the Data Exfiltration Guide is the most direct internal reference because it ties archive creation, local staging, removable media, and outbound transfer into one detection model. A general DLP program can also help by adding endpoint and network policy coverage, especially where users can compress or move sensitive files before they leave the host. See the Data Loss Prevention (DLP) Guide for that control layer.
What to correlate on the endpoint
The strongest Windows detections come from joining process execution, file creation, and network telemetry. Watch for archive tools, scripting hosts, office processes, or unusual child processes creating .zip, .7z, .rar, or similar outputs, especially if the archive lands in a temp folder, user profile, or a directory containing project, finance, legal, source code, or customer data. Password protection is harder to see directly, so the practical clue is often the archive tool plus the file creation sequence and an immediate shift toward outbound movement.
Correlate that local activity with the network side. An archive created minutes before an external upload, cloud sync, web POST, or large SMB copy is more suspicious than compression without follow-on egress. The same applies to archives copied to USB, mounted media, or shared staging locations that are not normal for that user or host. The intent is to identify packaging for transfer, not just routine backup or software distribution.
When the compression is part of a larger theft workflow, attackers may also compress data to shrink volume, conceal file names, or evade content inspection. The right pattern is therefore behavioral, not signature-only. A good baseline is to learn what archive creation looks like on finance workstations, engineering laptops, and servers that routinely handle bulk data, then alert on deviations in tool choice, destination path, timing, and transfer destination.
For Windows environments where exfiltration frequently follows credentialed access or post-compromise activity, it is useful to compare the local staging pattern with known adversary tradecraft. The MITRE ATT&CK Enterprise Matrix helps map archive-based staging and transfer behavior to adversary technique families, while the SANS Security Resources collection is a practical source for detection engineering and incident-response playbooks.
How to reduce false positives without missing real staging
Archive creation on its own is noisy, so detection quality depends on context. Backup jobs, software packaging, imaging, and collaboration tooling may compress large files legitimately. The key is to add conditions that make exfiltration more likely: sensitive directories, new or rare archive tools, password-protected output, compression on systems that do not normally compress data, and a close temporal link to external transfer or removable-media access.
It also helps to scope controls to high-value endpoints. Workstations used by administrators, finance, legal, developers, and data custodians are more likely to hold sensitive material worth staging. Those systems deserve stricter alerting thresholds, richer telemetry, and a lower tolerance for unusual compression behavior. If your tooling can inspect command lines, capture archive utility parameters, or flag unusual parent-child process chains, use that detail to separate everyday compression from exfiltration preparation.
For organizations that want a more structured policy anchor, the NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful control catalogue for audit, access, monitoring, and system-integrity expectations. If you need a broader architecture lens, the NIST Cybersecurity Framework 2.0 is a good way to connect detection, response, and recovery outcomes to the same threat pattern.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1560 — Archive Collected Data | Archive staging and packing are central to this exfiltration pattern. |
| T1020 — Data Exfiltration | The question is about detecting data transfer out of Windows hosts. | |
| Recommendation — Map archive creation to T1560 and alert on staging near sensitive data. Correlate compression with outbound transfer to detect T1020 activity. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Endpoint and network logs are needed to correlate process, file, and transfer events. |
| CIS-13 — Network Monitoring and Defense | Outbound transfer timing is a key indicator for staged exfiltration. | |
| Recommendation — Centralize endpoint telemetry so archive creation and egress can be correlated. Monitor unusual uploads and removable-media transfers from sensitive endpoints. | ||
| NIST CSF 2.0 | DE.CM-01 — The network is monitored to detect potential cybersecurity events | Detection depends on observing compression and egress as connected events. |
| Recommendation — Monitor endpoint and network activity for archive-and-transfer sequences. | ||
Practitioner Guidance
What to prioritise: Focus first on hosts that hold sensitive or regulated data, because archive creation becomes much more meaningful when it appears near high-value content and is followed by outbound transfer. A generic “compression happened” alert is usually too weak on its own.
What to verify: Confirm the full sequence, process that created the archive, file path of the source data, archive location, and the subsequent network or removable-media activity. If those events line up within a short window, treat the alert as staging for exfiltration rather than routine compression.
Common mistake: Teams often key only on the archive extension or password protection and miss the surrounding behavior. The better test is whether the endpoint is packaging sensitive files and then immediately moving them toward an external destination.
Practitioner takeaway: The best Windows detection is a correlation problem, not a file-type problem, if the archive, the sensitive source path, and the outbound transfer all align, the case deserves investigation even when each event alone looks mundane.
Related resources from NHI Mgmt Group
- How should security teams detect SAP compromise before data exfiltration starts?
- Who is accountable when backup privileges expose protected Windows data?
- How do security teams detect package-based data exfiltration in practice?
- How should security teams detect data exfiltration when policy rules are too rigid?