Password Protected ZIP File Opened

Status: test
Severity: medium
Log source: product windows, service security
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Known false positives

Legitimate used of encrypted ZIP files

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1027` Obfuscated Files or Information

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5379: Credential Manager credentials were read.

Rule body

title: Password Protected ZIP File Opened
id: 00ba9da1-b510-4f6b-b258-8d338836180f
status: test
description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
references:
    - https://twitter.com/sbousseaden/status/1523383197513379841
author: Florian Roth (Nextron Systems)
date: 2022-05-09
tags:
    - attack.stealth
    - attack.t1027
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5379
        TargetName|contains: 'Microsoft_Windows_Shell_ZipFolder:filename'
    filter:  # avoid overlaps with 54f0434b-726f-48a1-b2aa-067df14516e4
        TargetName|contains: '\Temporary Internet Files\Content.Outlook'
    condition: selection and not filter
falsepositives:
    - Legitimate used of encrypted ZIP files
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    EventID: 5379
    TargetName|contains: 'Microsoft_Windows_Shell_ZipFolder:filename'

Stage 2: `not filter`

filter:
    TargetName|contains: '\Temporary Internet Files\Content.Outlook'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TargetName`	match	`\Temporary Internet Files\Content.Outlook`	`excludes:TargetName` `field:"TargetName" value:"\Temporary Internet Files\Content.Outlook"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetName`	match	`Microsoft_Windows_Shell_ZipFolder:filename` corpus 3 (sigma 3)	`field:"TargetName" kind:match value:"Microsoft_Windows_Shell_ZipFolder:filename"`