Detect Archive via Custom Method by watching for unusual compression, packing, or container creation outside approved backup or software-distribution workflows. Look for archive tools, script-driven packaging, and sudden creation of encrypted or password-protected files used to stage data for exfiltration. Correlate file creation with process execution, destination paths, and large data transfers.
How detection works for Archive via Custom Method
The core detection problem is not the archive action itself, but the context around it. Teams should baseline where archiving is normally performed, which hosts are allowed to create archives, which tools are approved, and what the usual file sizes and destinations look like. Archive activity that appears in user workstations, admin shells, or unusual service contexts deserves scrutiny, especially when it is not tied to a known backup, deployment, or data transfer workflow.
Look for command-line compression utilities, scripting frameworks, and application-native packaging features that create archive files in ways your environment does not normally use. The strongest signals often come from custom or scripted archive creation combined with a burst of file reads, staging into temporary directories, encryption or password protection, and immediate movement toward a transfer location. That is why archive detection should be correlated with the preceding process tree and the next-hop destination, not treated as a standalone file event. Data Exfiltration Guide
In practice, the detection logic should distinguish legitimate bulk packaging from adversary staging. Backup jobs, software distribution pipelines, and approved content-sync tools can create archives at scale, but they usually do so from known paths, under known service accounts, and on predictable schedules. archive via custom method becomes more suspicious when the archive is created from scattered source files, renamed to blend in, or written into a path that later feeds cloud upload, removable-media transfer, or other outbound movement. MITRE ATT&CK Enterprise Matrix
What telemetry makes this activity stand out
File creation alone is too noisy, so the most useful telemetry is the join between process execution, file activity, and egress. Watch for archive creation preceded by discovery or collection behavior, followed by large writes, rename operations, or encrypted container creation. On endpoints, this often shows up as a script launching a compression utility or library call; in servers and cloud workloads, it may appear as a short-lived process that gathers data, creates an archive, and then hands it off to another process for transfer.
Destination matters as much as the archive itself. Archives created in user profile folders, temporary locations, or application cache paths are more suspicious when they are then moved to synchronization folders, object storage staging areas, or outbound transfer queues. If the archive is created with a password, encryption flag, or uncommon extension, that increases the likelihood that the file is meant to conceal content rather than support an ordinary business workflow. NIST Cybersecurity Framework 2.0
Analysts should also pay attention to parent process lineage and user context. A developer tool, backup agent, or build pipeline may create archives routinely, but the same behavior from a browser process, remote shell, or interactive admin session is more likely to represent staging. When archive creation is paired with sudden volume spikes or a transfer to an external service, the event should be treated as part of a broader exfiltration chain rather than a file-management task.
How to reduce false positives without blinding detection
False positives usually come from over-broad file rules that flag every zip, tar, or packaged artifact. A better approach is to anchor detections to business context: approved tools, scheduled jobs, signed binaries, known paths, and expected file types. Once those baselines are in place, deviations become much easier to isolate, such as archive creation from unsanctioned hosts, packaging of high-value directories, or archive generation immediately before outbound network activity.
Enrichment should focus on whether the archive content was sensitive, whether the archive was created by an approved workflow, and whether the file lifecycle matches normal retention behavior. A good rule is to treat archive creation as suspicious when it compresses data that should not normally be bundled together, especially if the archive is short-lived and quickly handed off to another process or destination. Data Exfiltration Guide
For teams that already monitor process, file, and network telemetry, the practical improvement is to correlate rather than expand the alert surface. Archive creation becomes a high-signal event when it sits between collection activity and an outbound transfer. That is the pattern defenders should tune for, because it captures both custom archive methods and the packaging step that often precedes exfiltration. SANS Security Resources
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1560 — Archive Collected Data | Archive via custom method is a collection/exfiltration technique in ATT&CK. |
| Recommendation — Map archive creation to T1560 and hunt for staging before exfiltration. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Detecting suspicious archive creation depends on continuous anomaly monitoring. |
| ID.RA-01 — Asset Vulnerabilities Identified | Suspicious archiving is easier to assess when sensitive assets and workflows are known. | |
| Recommendation — Monitor file, process, and transfer telemetry for abnormal archive creation patterns. Identify where sensitive data lives so archive events can be judged against expected workflows. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Archive detection relies on process and file telemetry correlated from logs. |
| CIS-13 — Network Monitoring and Defense | Outbound movement after archiving is a key part of the detection chain. | |
| Recommendation — Centralize endpoint and network logs needed to correlate archive creation with transfer. Correlate archive creation with unusual outbound transfers and staging destinations. | ||
Practitioner Guidance
What to verify: Confirm whether the archive was created by an approved backup, software distribution, or sync workflow before treating it as benign. The key question is not “Was a zip file made?” but “Was this archive created in a place, by a process, and at a time that matches an authorized business pattern?”
Decision rule: If archive creation is paired with unusual parent processes, encrypted or password-protected output, and an outbound destination, treat it as a staging event and escalate for triage. If the archive is only present as a routine artifact in a known job, suppress or downgrade it only after verifying the job identity and destination path.
What practitioners underestimate: Custom archive methods often hide in ordinary tooling, so the most useful detections are behavioral, not file-extension based. The strongest signal is the chain of collection, packaging, and transfer, not the archive event in isolation.
Practitioner takeaway: Detecting Archive via Custom Method is mainly a correlation problem, teams that can tie archive creation to process lineage and outbound movement will find far more than teams that watch for compressed files alone.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org