Execution from ZIP File via Explorer

[rule]
description = """
Identifies process execution from a ZIP file when handled via Explorer. Adversaries often leverage ZIP file to deliver
malicious executables and scripts for initial access and execution.
"""
id = "6631e7e4-ecca-4f34-88e1-b86a4ab711b1"
license = "Elastic License v2"
name = "Execution from ZIP File via Explorer"
os_list = ["windows"]
version = "1.0.11"

query = '''
process where event.action == "start" and
 process.parent.name : "explorer.exe" and process.parent.thread.Ext.call_stack_summary : "*zipfldr.dll*" and
  process.name : ("wscript.exe",
                  "cscript.exe",
                  "rundll32.exe",
                  "regsvr32.exe",
                  "cmstp.exe",
                  "RegAsm.exe",
                  "installutil.exe",
                  "mshta.exe",
                  "RegSvcs.exe",
                  "msbuild.exe",
                  "msxsl.exe",
                  "xwizard.exe",
                  "powershell.exe",
                  "AddInProcess.exe",
                  "AddInProcess32.exe",
                  "AddInUtil.exe",
                  "AppLaunch.exe",
                  "aspnet_compiler.exe") and
 not (process.parent.name : "explorer.exe" and process.executable : "C:\\Windows\\SysWOW64\\mshta.exe") and
 not (process.name : "rundll32.exe" and
          process.args : ("cryptext.dll,CryptExt*",
                          "ImageView_Fullscreen",
                          "?:\\Windows\\System32\\dfshim.dll,ShOpenVerbApplication",
                          "C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1"))
'''

min_endpoint_version = "8.7.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"


[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.7.0"