Compress Data and Lock With Password for Exfiltration With WINZIP — Detection Rule
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities