Password Protected ZIP File Opened (Suspicious Filenames)

Status: test
Severity: high
Log source: product windows, service security
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Known false positives

Legitimate used of encrypted ZIP files

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1027` Obfuscated Files or Information `T1036` Masquerading
Command & Control	`T1105` Ingress Tool Transfer

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5379: Credential Manager credentials were read.

Rule body

title: Password Protected ZIP File Opened (Suspicious Filenames)
id: 54f0434b-726f-48a1-b2aa-067df14516e4
status: test
description: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
references:
    - https://twitter.com/sbousseaden/status/1523383197513379841
author: Florian Roth (Nextron Systems)
date: 2022-05-09
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1027
    - attack.t1105
    - attack.t1036
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5379
        TargetName|contains: 'Microsoft_Windows_Shell_ZipFolder:filename'
    selection_filename:
        TargetName|contains:
            - 'invoice'
            - 'new order'
            - 'rechnung'
            - 'factura'
            - 'delivery'
            - 'purchase'
            - 'order'
            - 'payment'
    condition: selection and selection_filename
falsepositives:
    - Legitimate used of encrypted ZIP files
level: high

Stages and Predicates

Stage 0: `condition`

selection and selection_filename

Stage 1: `selection`

selection:
    EventID: 5379
    TargetName|contains: 'Microsoft_Windows_Shell_ZipFolder:filename'

Stage 2: `selection_filename`

selection_filename:
    TargetName|contains:
        - 'invoice'
        - 'new order'
        - 'rechnung'
        - 'factura'
        - 'delivery'
        - 'purchase'
        - 'order'
        - 'payment'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetName`	match	`Microsoft_Windows_Shell_ZipFolder:filename` corpus 3 (sigma 3) `delivery` `factura` `invoice` `new order` `order` `payment` `purchase` `rechnung`	`field:"TargetName" kind:match`