CmdID

CmdID / PowerShell / Cmdlets / Compress

Compress-Archive

Creates a compressed archive, or zipped file, from specified files and directories. PowerShell reference

From the PowerShell reference 8 parameters 2 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Creates a compressed archive, or zipped file, from specified files and directories. The Compress-Archive cmdlet creates a compressed, or zipped, archive file from one or more specified files or directories. An archive packages multiple files, with optional compression, into a single zipped file for easier distribution and storage. An archive file can be compressed using the compression algorithm specified by the CompressionLevel parameter. The Compress-Archive cmdlet uses the System.IO.Compression.ZipArchive API to compress files. The API limits the maximum file size to 2GB. For more information, see System.IO.Compression.ZipArchive. NOTE: The Compress-Archive cmdlet ignores hidden files and folders when creating or updating the archive file. To ensure hidden files and folders are compressed into the archive, use the .NET API instead. Some examples use splatting to reduce the line length of the code samples. For more information, see about_Splatting.

Compress-Archive [-Path] <String[]> [-DestinationPath] <String> [-CompressionLevel <String>] [-WhatIf] [-Confirm] [<CommonParameters>]
Compress-Archive [-Path] <String[]> [-DestinationPath] <String> [-CompressionLevel <String>] -Update [-WhatIf] [-Confirm] [<CommonParameters>]
Compress-Archive [-Path] <String[]> [-DestinationPath] <String> [-CompressionLevel <String>] -Force [-WhatIf] [-Confirm] [<CommonParameters>]
Compress-Archive -LiteralPath <String[]> [-DestinationPath] <String> [-CompressionLevel <String>] -Update [-WhatIf] [-Confirm] [<CommonParameters>]
Compress-Archive -LiteralPath <String[]> [-DestinationPath] <String> [-CompressionLevel <String>] -Force [-WhatIf] [-Confirm] [<CommonParameters>]
Compress-Archive -LiteralPath <String[]> [-DestinationPath] <String> [-CompressionLevel <String>] [-WhatIf] [-Confirm] [<CommonParameters>]

Compress files to create an archive file

$compress = @{ Path = "C:\Reference\Draftdoc.docx", "C:\Reference\Images\*.vsd" CompressionLevel = "Fastest" DestinationPath = "C:\Archives\Draft.zip" } Compress-Archive @compressIdentify

Compress files using a LiteralPath

$compress = @{ LiteralPath= "C:\Reference\Draft Doc.docx", "C:\Reference\Images\diagram2.vsd" CompressionLevel = "Fastest" DestinationPath = "C:\Archives\Draft.zip" } Compress-Archive @compressIdentify

Compress a directory that includes the root directory

Compress-Archive -Path C:\Reference -DestinationPath C:\Archives\Draft.zipIdentify

Compress a directory that excludes the root directory

Compress-Archive -Path C:\Reference\* -DestinationPath C:\Archives\Draft.zipIdentify

Compress only the files in a root directory

Compress-Archive -Path C:\Reference\*.* -DestinationPath C:\Archives\Draft.zipIdentify

Use the pipeline to archive files

Get-ChildItem -Path C:\Reference\Afile.txt, C:\Reference\Images\Bfile.txt | Compress-Archive -DestinationPath C:\Archives\PipelineFiles.zipIdentify

Use the pipeline to archive a directory

Get-ChildItem -Path C:\LogFiles | Compress-Archive -DestinationPath C:\Archives\PipelineDir.zipIdentify

How recursion can affect archives

Get-ChildItem -Path C:\TestLog -Recurse | Compress-Archive -DestinationPath C:\Archives\PipelineRecurse.zipIdentify

Update an existing archive file

Compress-Archive -Path C:\Reference -Update -DestinationPath C:\Archives\Draft.zipIdentify

Its page in the reference: Compress-Archive.

Parameters

8 in the PowerShell reference
-CompressionLevelSpecifies how much compression to apply when you're creating the archive file. Faster compression requires less time to create the file, but can result in larger file sizes. If this parameter isn't specified, the command uses the default value, Optimal. The following are the acceptable values for this parameter: - Fastest. Use the fastest compression method available to reduce processing time. Faster compression can result in larger file sizes. - NoCompression. Doesn't compress the source files. - Optimal. Processing time is dependent on file size.
-DestinationPathThis parameter is required and specifies the path to the archive output file. The DestinationPath should include the name of the zipped file, and either the absolute or relative path to the zipped file. If the file name in DestinationPath doesn't have a .zip file name extension, the cmdlet adds the .zip file name extension.
-ForceUse this parameter to overwrite an existing archive file.
-LiteralPathSpecifies the path or paths to the files that you want to add to the archive zipped file. Unlike the Path parameter, the value of LiteralPath is used exactly as it's typed. No characters are interpreted as wildcards. If the path includes escape characters, enclose each escape character in single quotation marks, to instruct PowerShell not to interpret any characters as escape sequences. To specify multiple paths, and include files in multiple locations in your output zipped file, use commas to separate the paths.
-PathSpecifies the path or paths to the files that you want to add to the archive zipped file. To specify multiple paths, and include files in multiple locations, use commas to separate the paths. This parameter accepts wildcard characters. Wildcard characters allow you to add all files in a directory to your archive file. Using wildcards with a root directory affects the archive's contents: - To create an archive that includes the root directory, and all its files and subdirectories, specify the root directory in the Path without wildcards. For example: -Path C:\Reference - To create an archive that excludes the root directory, but zips all its files and subdirectories, use the asterisk (*) wildcard. For example: -Path C:\Reference\* - To create an archive that only zips the files in the root directory, use the star-dot-star (*.*) wildcard. Subdirectories of the root aren't included in the archive. For example: -Path C:\Reference\*.*
-UpdateUpdates the specified archive by replacing older file versions in the archive with newer file versions that have the same names. You can also add this parameter to add files to an existing archive.
-ConfirmPrompts you for confirmation before running the cmdlet.
-WhatIfShows what would happen if the cmdlet runs. The cmdlet isn't run.

What looks for it

Sigma process creation rules that name Compress-Archive
highForest Blizzard APT - Process Creation ActivityNasreddine Bencherchali (Nextron Systems)
mediumFolder Compress To Potentially Suspicious Output Via Compress-Archive CmdletNasreddine Bencherchali (Nextron Systems), frack113