detection.wiki

Detection rules › Panther

CrowdStrike Large Zip Creation

Source
github.com/panther-labs/panther-analysis

Detects creation of large zip files, which can indicate attempts of exfiltration

MITRE ATT&CK coverage

TacticTechniques
CollectionT1560.001 Archive Collected Data: Archive via Utility

Rule body yaml

AnalysisType: scheduled_query
Description: Detects creation of large zip files, which can indicate attempts of exfiltration
Enabled: false
Query: |
  select
    ppr.commandline as parent_commandline,
    zip_proc.*
  from
    (
    select
      zips.*,
      pr2.targetprocessid as process_targetpid,
      pr2.parentprocessid as process_parentpid,
      pr2.commandline as process_commandline
    from
      (
        select
          *
        from
          panther_logs.public.crowdstrike_unknown
        where
          event_simpleName IN (
            'GzipFileWritten',
            'SevenZipFileWritten',
            'ZipFileWritten',
            'BZip2FileWritten'
          )
          and p_occurs_since('1 day')
          and CAST(unknown_payload:Size as integer) > 10000000
      ) zips
      left join panther_logs.public.crowdstrike_processrollup2 pr2
      on zips.ContextProcessId = pr2.targetprocessid

      where
      pr2.commandline like any(
        '%zip%'
      )

      and not (
        pr2.commandline like any (
          '%curl%',
          '/Application%',
          '%install%'
        )
      )

    ) zip_proc
    LEFT JOIN panther_logs.public.crowdstrike_processrollup2 ppr
    on zip_proc.process_parentpid = ppr.targetprocessid
  where
    (
      (parent_commandline is null) or
      not (parent_commandline like any (
        '%homebrew%',
        '%Homebrew%',
        '/Application%',
        '%install%'
        )
      )
    )
QueryName: "CrowdStrike Large Zip Creation"
Schedule:
  RateMinutes: 1440
  TimeoutMinutes: 5