Threat Actors may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, Threat Actors may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.