Detection rules › Splunk
Utility Archive Data (PowerShell)
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities. Many utilities exist that can archive data, including 7-Zip, WinRAR, and WinZip. Most utilities include functionality to encrypt and/or compress data
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body
id: '5526.5752'
title: Utility Archive Data
description: 'An adversary may compress or encrypt data that is collected prior to
exfiltration using 3rd party utilities. Many utilities exist that can archive data,
including 7-Zip, WinRAR, and WinZip. Most utilities include functionality to encrypt
and/or compress data. -- Threat Actor Association: APT10/Cicada, APT27/Emissary
Panda, APT29/Nobelium/Cozy Bear, APT31, DarkSide, BlackMatter, FIN6, FIN7, Harvester,
Karakurt, Lancyfly, Lazarus, Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
PRESIDENT/TA416/RedDelta), RedEyes, UNC5221, UTA0178. Volt Typhoon - Software Association:
Akira, AvosLocker, Clop, Conti, GhostShell, Hafnium, LockBit, Play, Quantum, Ransom
Cartel -- #TrendingThreat #Russia #Ukraine -- Atomics T1560.001 Test#1 Atomics T1560.001
Test#2 Atomics T1560.001 Test#3 Atomics T1560.001 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(WinRAR.exe)
OR TERM(WinRAR) OR TERM(rar.exe) OR TERM(rar) OR TERM(7zG.exe) OR TERM(7zG) OR TERM(peazip.exe)
OR TERM(peazip) OR TERM(powerarc.exe) OR TERM(powerarc) OR TERM(Bandizip.exe) OR
TERM(Bandizip) OR TERM(Zipware.exe) OR TERM(Zipware) OR TERM(winzip)) | regex process_name="(?i)(winrar|rar|7z*|peazip|powerarc|bandizip|zipware|winzip*)\.exe"|
table _time, host, user signature_id, process, process_* | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- collection:archive collected data:archive via utility
technique_id:
- T1560.001
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://askleo.com/why-spammers-love-zip-files-and-how-you-need-to-stay-safe/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` TERM(EventCode=4104) (TERM(WinRAR.exe) OR TERM(WinRAR) OR TERM(rar.exe) OR TERM(rar) OR TERM(7zG.exe) OR TERM(7zG) OR TERM(peazip.exe) OR TERM(peazip) OR TERM(powerarc.exe) OR TERM(powerarc) OR TERM(Bandizip.exe) OR TERM(Bandizip) OR TERM(Zipware.exe) OR TERM(Zipware) OR TERM(winzip))
Stage 2: regex
| regex process_name="(?i)(winrar|rar|7z*|peazip|powerarc|bandizip|zipware|winzip*)\.exe"
Stage 3: table
| table _time, host, user signature_id, process, process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4104" |
process_name | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | WinRAR.exe |
| 1 | WinRAR |
| 1 | rar.exe |
| 1 | rar |
| 1 | 7zG.exe |
| 1 | 7zG |
| 1 | peazip.exe |
| 1 | peazip |
| 1 | powerarc.exe |
| 1 | powerarc |
| 1 | Bandizip.exe |
| 1 | Bandizip |
| 1 | Zipware.exe |
| 1 | Zipware |
| 1 | winzip |