Windows system logs show PowerShell zipping up the contents of a user’s profile folder. Investigate process and file events to determine the exact name of the ZIP archive created.

DeviceFileEvents
| where ActionType == "FileCreated"
| where FileName endswith ".zip"
| where InitiatingProcessFileName =~ "powershell.exe"
| where InitiatingProcessCommandLine has "Compress-Archive" or InitiatingProcessCommandLine has ".Compression.FileSystem"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, FolderPath, InitiatingProcessAccountName

DeviceProcessEvents
| where InitiatingProcessFileName == 'powershell.exe' and ProcessCommandLine has 'Compress-Archive'
| project DeviceId, ProcessId, ProcessCreationTime, ProcessCommandLine
| join kind=inner (
    DeviceFileEvents
    | where ActionType == 'FileCreated' and FileName endswith '.zip'
) on DeviceId
| project FileName, ProcessCommandLine, TimeGenerated

DeviceFileEvents
| where ActionType == "FileCreated"
// Focus on ZIP archive creations
| where FileName endswith ".zip"
// Initiated by PowerShell
| where InitiatingProcessFileName =~ "powershell.exe"
// Profile folder paths typically contain '\Users\' or similar.
| where FolderPath has "\\Users\\"
| project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain
| sort by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has @".zip"
| take 100

DeviceFileEvents
| where InitiatingProcessFileName has "powershell.exe" and FileName endswith ".zip"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FileName, FolderPath
| order by TimeGenerated desc
| take 10

let ps_zip_procs =
DeviceProcessEvents
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("Compress-Archive","ZipFile]::CreateFromDirectory","System.IO.Compression.FileSystem","System.IO.Compression.ZipFile")
| where ProcessCommandLine has_any ("C\\Users\\","$env:USERPROFILE","%USERPROFILE%")
| extend ZipDestFromCmd = coalesce(
    extract('-DestinationPath\\s+"([^"]+\\.zip)"', 1, ProcessCommandLine),
    extract("-DestinationPath\\s+'([^']+\\.zip)'", 1, ProcessCommandLine),
    extract("-DestinationPath\\s+([^\\s]+\\.zip)", 1, ProcessCommandLine),
    extract('ZipFile\\]::CreateFromDirectory\\([^,]+,\\s+"([^"]+\\.zip)"', 1, ProcessCommandLine),
    extract("ZipFile\\]::CreateFromDirectory\\([^,]+,\\s+'([^']+\\.zip)'", 1, ProcessCommandLine),
    extract("ZipFile\\]::CreateFromDirectory\\([^,]+,\\s+([^\\s\\)]+\\.zip)", 1, ProcessCommandLine)
)
| project DeviceId, DeviceName, ProcessId, ProcessCreationTime, AccountDomain, AccountName, ProcessCommandLine, ZipDestFromCmd;

let zip_file_events =
DeviceFileEvents
| where ActionType in~ ("FileCreated","FileRenamed","FileMoved")
| where tolower(FileName) endswith ".zip"
| where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe")
| extend ZipFullPath = iff(isempty(FolderPath), FileName, strcat(FolderPath, "\\", FileName))
| project DeviceId, DeviceName, ZipFullPath, FileName, FolderPath, FileSize, FileEventTime=TimeGenerated,
          InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessCommandLine,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName;

zip_file_events
| join kind=leftouter (ps_zip_procs) on DeviceId, $left.InitiatingProcessId == $right.ProcessId
| where (
    (isnotempty(InitiatingProcessCommandLine) and InitiatingProcessCommandLine has_any ("Compress-Archive","ZipFile]::CreateFromDirectory","System.IO.Compression"))
    or (isnotempty(ProcessCommandLine) and ProcessCommandLine has_any ("Compress-Archive","ZipFile]::CreateFromDirectory","System.IO.Compression"))
)
| where (
    (isnotempty(InitiatingProcessCommandLine) and InitiatingProcessCommandLine has_any ("C\\Users\\","$env:USERPROFILE","%USERPROFILE%"))
    or (isnotempty(ProcessCommandLine) and ProcessCommandLine has_any ("C\\Users\\","$env:USERPROFILE","%USERPROFILE%"))
)
| summarize FirstSeen=min(FileEventTime),
            FileSize=any(FileSize),
            DeviceName=any(DeviceName),
            InitiatingProcessId=any(InitiatingProcessId),
            InitiatingProcessCreationTime=any(InitiatingProcessCreationTime),
            InitiatingCmd=any(InitiatingProcessCommandLine),
            AccountDomain=any(InitiatingProcessAccountDomain),
            AccountName=any(InitiatingProcessAccountName),
            PSProcessCmd=any(ProcessCommandLine),
            ZipPathFromCmd=any(ZipDestFromCmd)
  by ZipFullPath, DeviceId
| order by FirstSeen asc

// Find PowerShell processes that likely created ZIPs and correlate to .zip file writes
let psProcs = DeviceProcessEvents
| where ProcessCommandLine has_any ("powershell", "pwsh.exe", "powershell.exe")
// Restrict to typical archive-creating cmdlets or .NET/Compression usage
| where ProcessCommandLine has_any ("Compress-Archive", "CompressArchive", "System.IO.Compression", "Ionic.Zip", "ZipArchive", ".zip")
| project DeviceId, DeviceName, ProcTime = TimeGenerated, ProcessId, ProcessCreationTime, InitiatingProcessId, ProcCommandLine = ProcessCommandLine, ProcFileName = FileName, ProcFolderPath = FolderPath, AccountName, AccountDomain, InitiatingProcessFileName;

let fileEvents = DeviceFileEvents
| where FileName endswith ".zip" or FileName has ".zip"
| project DeviceId, DeviceName, FileTime = TimeGenerated, FileFolder = FolderPath, FileName, FileSize, FileAction = ActionType, FileInitiatingProcessId = InitiatingProcessId, FileInitiatingCmd = InitiatingProcessCommandLine, FileInitiatingName = InitiatingProcessFileName, RequestAccountName;

let genericFileEvents = DeviceEvents
| where FileName endswith ".zip" or FileName has ".zip"
| project DeviceId, DeviceName, FileTime = TimeGenerated, FileFolder = FolderPath, FileName, FileSize, FileAction = ActionType, Gen_ProcessId = ProcessId, Gen_ProcessCommandLine = ProcessCommandLine, Gen_InitiatingProcessName = InitiatingProcessFileName, Gen_InitiatingProcessId = InitiatingProcessId;

// Join ps processes to fileEvents by DeviceId and either matching initiating process id or time proximity
psProcs
| join kind=leftouter (
    fileEvents
) on DeviceId
| extend pid_match = iif(isnotempty(FileInitiatingProcessId) and FileInitiatingProcessId == ProcessId, 1, 0)
| where pid_match == 1 or (FileTime between (ProcessCreationTime - 1m .. ProcessCreationTime + 30m))
| project DeviceName, DeviceId, ProcessId, ProcessCreationTime, ProcCommandLine, ZipFile = FileName, ZipFolder = FileFolder, ZipFileTime = FileTime, FileSize, FileAction, FileInitiatingName, FileInitiatingCmd

| union (
    // also correlate with generic DeviceEvents file records
    psProcs
    | join kind=leftouter (
        genericFileEvents
    ) on DeviceId
    | extend pid_match = iif(isnotempty(Gen_InitiatingProcessId) and Gen_InitiatingProcessId == ProcessId, 1, 0)
    | where pid_match == 1 or (FileTime between (ProcessCreationTime - 1m .. ProcessCreationTime + 30m))
    | project DeviceName, DeviceId, ProcessId, ProcessCreationTime, ProcCommandLine, ZipFile = FileName, ZipFolder = FileFolder, ZipFileTime = FileTime, FileSize, FileAction, FileInitiatingName = Gen_InitiatingProcessName, FileInitiatingCmd = Gen_ProcessCommandLine
)
| where ZipFile has ".zip"
| summarize FirstSeen = min(ZipFileTime), LastSeen = max(ZipFileTime), AnySize = any(FileSize), AnyAction = any(FileAction), AnyInitiatingName = any(FileInitiatingName), AnyInitiatingCmd = any(FileInitiatingCmd) by DeviceName, DeviceId, ProcessId, ProcCommandLine, ZipFile, ZipFolder
| project DeviceName, DeviceId, ProcessId, ProcCommandLine, ZipFile, ZipFolder, FirstSeen, LastSeen, AnySize, AnyAction, AnyInitiatingName, AnyInitiatingCmd
| order by FirstSeen desc
| take 100

// Identify PowerShell processes with compression-like activity
let ps_procs = DeviceProcessEvents
| where Timestamp between (startofday(ago(7d)) .. now())
| where tolower(FileName) has_any ("powershell","pwsh","powershell.exe","pwsh.exe")
| where isnotempty(ProcessCommandLine) and (
    ProcessCommandLine contains "Compress-Archive" or
    ProcessCommandLine contains "CompressArchive" or
    ProcessCommandLine contains "ZipFile" or
    ProcessCommandLine contains "System.IO.Compression" or
    ProcessCommandLine contains ".zip" or
    ProcessCommandLine contains "Expand-Archive" or
    ProcessCommandLine contains "Add-Type" or
    ProcessCommandLine contains "-zip" or
    ProcessCommandLine contains "New-Item" and ProcessCommandLine contains "-ItemType" and ProcessCommandLine contains "file"
)
| project DeviceId, DeviceName, ProcessId, ProcTime=Timestamp, ProcessCreationTime, ProcessCommandLine, Account=coalesce(InitiatingProcessAccountName, AccountName), AccountDomain=coalesce(InitiatingProcessAccountDomain, AccountDomain), ReportId;

// Collect .zip file events from DeviceFileEvents
let zip_file_events = DeviceFileEvents
| where Timestamp between (startofday(ago(7d)) .. now())
| where isnotempty(FileName) and tolower(FileName) endswith ".zip"
| extend Action = tostring(ActionType)
| project DeviceId, DeviceName, ZipName=FileName, FolderPath, ZipSize=FileSize, FileAction=Action, InitiatingProcessId=InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, FileTime=Timestamp;

// Also check DeviceEvents for any .zip references
let zip_deviceevents = DeviceEvents
| where Timestamp between (startofday(ago(7d)) .. now())
| where isnotempty(FileName) and tolower(FileName) endswith ".zip"
| extend Action = tostring(ActionType)
| project DeviceId, DeviceName, ZipName=FileName, FolderPath, ZipSize=FileSize, FileAction=Action, InitiatingProcessId=InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, FileTime=Timestamp;

let all_zips = union zip_file_events, zip_deviceevents
| summarize any_FolderPath=any(FolderPath), any_ZipSize=any(ZipSize), FileActions=make_set(FileAction), InitiatingProcessId=any(InitiatingProcessId), InitiatingProcessFileName=any(InitiatingProcessFileName), InitiatingProcessCommandLine=any(InitiatingProcessCommandLine), InitiatingProcessAccountName=any(InitiatingProcessAccountName), InitiatingProcessAccountDomain=any(InitiatingProcessAccountDomain), FirstSeen=min(FileTime), LastSeen=max(FileTime) by DeviceId, DeviceName, ZipName;

// Join PowerShell processes to zip file events by DeviceId and either matching process id or time proximity (±5 min)
ps_procs
| join kind=leftouter (
    all_zips
) on DeviceId
| where (
    (isnotempty(InitiatingProcessId) and tolong(InitiatingProcessId) == ProcessId)
    or (isnotempty(FirstSeen) and abs(datetime_diff('second', ProcTime, FirstSeen)) <= 300)
    or (isnotempty(LastSeen) and abs(datetime_diff('second', ProcTime, LastSeen)) <= 300)
)
| extend ZipPath = strcat(coalesce(any_FolderPath, ""), iff(coalesce(any_FolderPath, "") == "", "", "\\"), ZipName)
| project DeviceName, DeviceId, Account, AccountDomain, ProcessId, ProcessCreationTime, ProcessCommandLine, ProcTime, ZipName, ZipPath, ZipSize=any_ZipSize, FileActions = tostring(FileActions), FileFirstSeen = FirstSeen, FileLastSeen = LastSeen
| order by FileLastSeen desc
| distinct DeviceId, DeviceName, Account, AccountDomain, ProcessId, ProcessCommandLine, ZipName, ZipPath, ZipSize, FileActions, FileFirstSeen, FileLastSeen

let TimeRange = ago(7d);
DeviceProcessEvents
| where TimeGenerated >= TimeRange
| where InitiatingProcessFileName =~ 'powershell.exe'
| where ProcessCommandLine has_any ('Compress-Archive', 'zip', 'DestinationPath', '-Path')
| project ProcessTimestamp=Timestamp, DeviceId, DeviceName, InitiatingProcessId, ProcessCommandLine, ProcessCreationTime
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated >= TimeRange
    | where FileName endswith '.zip'
    | where ActionType == 'FileCreated'
    | project FileTimestamp=Timestamp, DeviceId, FileName, FolderPath
) on DeviceId
| where FileTimestamp between (ProcessCreationTime .. timespan(10m))
| project ProcessTimestamp, DeviceName, FileName, FolderPath, ProcessCommandLine
| order by ProcessTimestamp desc

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| project DeviceId,
          HostName=DeviceName,
          PSPID=ProcessId,
          PSCommandLine=ProcessCommandLine,
          PSTime=TimeGenerated
| join kind=inner (
    DeviceFileEvents
    | where ActionType == "FileCreated" and FileName endswith ".zip"
    | project DeviceId,
              FileCreatedTime=TimeGenerated,
              ZipFolderPath=FolderPath,
              ZipFileName=FileName,
              ParentPID=InitiatingProcessId
) on $left.DeviceId == $right.DeviceId and $left.PSPID == $right.ParentPID
| project FileCreatedTime,
          HostName,
          ZipFolderPath,
          ZipFileName,
          PSCommandLine
| order by FileCreatedTime desc

DeviceFileEvents
| where ActionType in ("FileCreated", "FileCreatedOrModified")
| where FolderPath startswith "C:\\Users\\"
| where FileName endswith ".zip"
| where InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessCommandLine has "powershell"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, InitiatingProcessAccountName
| order by TimeGenerated desc

// -------------------------------------------------------------
//  PowerShell suspected of zipping a user profile – find the ZIP
// -------------------------------------------------------------
// 1.  Candidate PowerShell sessions that look like they are doing
//     compression / archiving.
let PsCompression =
    DeviceProcessEvents
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("Compress-Archive", "compress-archive", ".zip", "System.IO.Compression")
    | project DeviceId,
              DeviceName,
              PsPID              = ProcessId,
              PsSessionId        = CreatedProcessSessionId,
              PsStartTime        = TimeGenerated,
              AccountName,
              AccountDomain,
              ProcessCommandLine;

// 2.  File-system events that actually create / rename / copy a ZIP file.
let ZipEvents =
    DeviceFileEvents
    | where ActionType in ("FileCreated", "FileCreated (CreateFile)", "FileRenamed", "FileCopied", "FileMoved")
    | where FileName endswith_cs ".zip"
    // optional: focus on user-profile area – comment out if not needed
    //| where FolderPath startswith_cs "C:\\Users\\"
    | extend ZipEventTime = TimeGenerated,
             ZipFullPath  = iff(isempty(FolderPath), FileName, strcat(FolderPath, "\\", FileName))
    | project DeviceId,
              InitiatingProcessId,
              InitiatingProcessSessionId,
              ZipFullPath,
              ZipEventTime;

// 3.  Correlate – same device and (same PID OR same session id) and close in time.
ZipEvents
| join kind=inner (
        PsCompression
    ) on DeviceId
| where (InitiatingProcessId == PsPID or InitiatingProcessSessionId == PsSessionId)
| where ZipEventTime between (PsStartTime - 5m .. PsStartTime + 2h)

// 4.  Return one row per archive with context.
| summarize arg_max(ZipEventTime, ZipFullPath, ProcessCommandLine, PsStartTime) by DeviceName, AccountDomain, AccountName
| project Timestamp       = ZipEventTime,
          DeviceName,
          Account          = strcat(AccountDomain, "\\", AccountName),
          ZipArchivePath   = ZipFullPath,
          PowerShellCmd    = ProcessCommandLine
| order by Timestamp asc

union
  (DeviceProcessEvents
    | where InitiatingProcessCommandLine has "powershell"
    | where InitiatingProcessCommandLine has "Compress-Archive"
  ),
  (DeviceFileEvents
    | where FileName endswith ".zip"
    | where FolderPath has "C:\\Users\\"
  )
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessCommandLine, SourceSystem, Type
| sort by TimeGenerated desc

let CompressEvents =
    DeviceProcessEvents
    // Identify PowerShell compress-archive commands
    | where FileName == "powershell.exe"
    | where ProcessCommandLine has "Compress-Archive"
    | project
        DeviceId,
        DeviceName,
        CompressProcessId = ProcessId,
        CompressTime = TimeGenerated,
        User = AccountName,
        CommandLine = ProcessCommandLine;

let ZipFileCreations =
    DeviceFileEvents
    // Capture created ZIP files
    | where ActionType in ("Created", "FileCreated")
    | where FileName endswith ".zip"
    | project
        DeviceId,
        ZipCreationTime = TimeGenerated,
        InitiatingProcessId,
        ZipFileName = FileName,
        ZipFullPath = strcat(FolderPath, "\\", FileName);

// Correlate the compress command with the ZIP file creation
CompressEvents
| join kind=inner ZipFileCreations
    on $left.DeviceId == $right.DeviceId
    and $left.CompressProcessId == $right.InitiatingProcessId
| project
    ZipCreationTime,
    DeviceId,
    DeviceName,
    User,
    ZipFileName,
    ZipFullPath,
    CommandLine
| sort by ZipCreationTime desc