Detect Compression in Microsoft Sentinel

// T1027.015 - Compression
// Detect suspicious archive extraction patterns, SFX execution, and nested archive delivery
let SuspiciousExtraction = DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where (
    // 7zip / WinRAR extracting to suspicious staging paths
    (FileName in~ ("7z.exe", "7za.exe", "7zr.exe", "winrar.exe", "unrar.exe") 
     and ProcessCommandLine has_any ("x ", "e ", "t ")
     and ProcessCommandLine has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\")
    )
    // PowerShell GZip/Deflate decompress pattern
    or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("GZipStream", "DeflateStream", "IO.Compression", "System.IO.Compression"))
    // Expand-Archive extracting to temp/staging location
    or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Expand-Archive", "Extract()", "ExtractToDirectory") 
        and ProcessCommandLine has_any ("\\Temp\\", "\\AppData\\", "\\ProgramData\\"))
)
| extend DetectionType = case(
    FileName in~ ("7z.exe", "7za.exe", "7zr.exe", "winrar.exe", "unrar.exe"), "archive_tool_extraction_staging",
    ProcessCommandLine has_any ("GZipStream", "DeflateStream"), "powershell_memory_decompress",
    "powershell_extract_archive_staging"
);
let SelfExtractingArchive = DeviceProcessEvents
| where ActionType == "ProcessCreated"
// SFX archives: executable file that extracts and runs content without external tools
| where FileName endswith ".exe"
| where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\Desktop\\", "\\AppData\\", "\\Users\\Public\\")
| where InitiatingProcessFileName in~ ("explorer.exe", "outlook.exe", "winword.exe", "excel.exe", "chrome.exe", "msedge.exe", "firefox.exe")
// SFX processes often spawn cmd.exe or powershell.exe immediately after extraction
| join kind=inner (
    DeviceProcessEvents
    | where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "wscript.exe")
    | where InitiatingProcessFolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\AppData\\")
) on DeviceId
| extend DetectionType = "self_extracting_archive_exec";
let NestedArchiveDelivery = DeviceFileEvents
| where ActionType == "FileCreated"
| where FileName endswith ".zip" or FileName endswith ".rar" or FileName endswith ".7z"
| where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\AppData\\")
// High-risk parent process: email client or browser downloading the archive
| where InitiatingProcessFileName in~ ("outlook.exe", "thunderbird.exe", "chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe")
| extend DetectionType = "archive_via_email_or_browser";
SuspiciousExtraction
| union SelfExtractingArchive
| union NestedArchiveDelivery
| project-reorder Timestamp, DeviceName, DetectionType, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName