Suspicious Greedy Compression Using Rar.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Suspicious Greedy Compression Using Rar.EXE
id: afe52666-401e-4a02-b4ff-5d128990b8cb
status: test
description: Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes
references:
    - https://decoded.avast.io/martinchlumecky/png-steganography
author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems)
date: 2022-12-15
modified: 2024-01-02
tags:
    - attack.execution
    - attack.t1059
logsource:
    product: windows
    category: process_creation
detection:
    # Example : rar.exe a -m5 -r -y -ta20210204000000 -hp1qazxcde32ws -v2560k Asia1Dpt-PC-c.rar c:\\*.doc c:\\*.docx c:\\*.xls c:\\*.xlsx c:\\*.pdf c:\\*.ppt c:\\*.pptx c:\\*.jpg c:\\*.txt >nul
    selection_opt_1:
        - Image|endswith: '\rar.exe'
        - Description: 'Command line RAR'
    selection_opt_2:
        CommandLine|contains:
            - '.exe a '
            - ' a -m'
    selection_cli_flags:
        CommandLine|contains|all:
            - ' -hp' # password
            - ' -r ' # recursive
    selection_cli_folders:
        CommandLine|contains:
            - ' ?:\\\*.'
            - ' ?:\\\\\*.'
            - ' ?:\$Recycle.bin\'
            - ' ?:\PerfLogs\'
            - ' ?:\Temp'
            - ' ?:\Users\Public\'
            - ' ?:\Windows\'
            - ' %public%'
    condition: 1 of selection_opt_* and all of selection_cli_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_opt_* and all of selection_cli_*

Stage 1: `selection_opt_1`

selection_opt_1:
    - Image|endswith: '\rar.exe'
    - Description: 'Command line RAR'

Stage 2: `selection_opt_2`

selection_opt_2:
    CommandLine|contains:
        - '.exe a '
        - ' a -m'

Stage 3: `selection_cli_flags`

selection_cli_flags:
    CommandLine|contains|all:
        - ' -hp'
        - ' -r '

Stage 4: `selection_cli_folders`

selection_cli_folders:
    CommandLine|contains:
        - ' ?:\\\*.'
        - ' ?:\\\\\*.'
        - ' ?:\$Recycle.bin\'
        - ' ?:\PerfLogs\'
        - ' ?:\Temp'
        - ' ?:\Users\Public\'
        - ' ?:\Windows\'
        - ' %public%'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`%public%` `-hp` corpus 4 (sigma 4) `-r` corpus 10 (sigma 10) `?:\$Recycle.bin\` `?:\PerfLogs\` `?:\Temp` `?:\Users\Public\` `?:\Windows\` `?:\\\.` `?:\\\\\.` `a -m` `.exe a`	`field:"CommandLine" kind:match`
`Description`	eq	`Command line RAR` corpus 3 (sigma 3)	`field:"Description" kind:eq value:"Command line RAR"`
`Image`	ends_with	`\rar.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\rar.exe"`

Suspicious Greedy Compression Using Rar.EXE

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_opt_1

Stage 2: selection_opt_2