Detection rules › By event

Microsoft-Windows-Security-Auditing event 5379

3 detection rules reference this event. View event page.

Sigma (3)

Password Protected ZIP File Opened severity medium T1027
Password Protected ZIP File Opened (Email Attachment) severity high T1027, T1566.001
Password Protected ZIP File Opened (Suspicious Filenames) severity high T1027, T1036, T1105