Legitimate Application Dropped Archive

Severity: high
Author: frack113, Florian Roth
Source: upstream

Detects programs on a Windows system that should not write an archive to disk

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1218` System Binary Proxy Execution

Event coverage

Provider	Event ID	Title
Sysmon	11	FileCreate

Stages and Predicates

Stage 1: `selection`

or:
Image|endswith: '\AcroRd32.exe'
Image|endswith: '\CertReq.exe'
Image|endswith: '\Desktopimgdownldr.exe'
Image|endswith: '\RdrCEF.exe'
Image|endswith: '\certoc.exe'
Image|endswith: '\certutil.exe'
Image|endswith: '\eqnedt32.exe'
Image|endswith: '\esentutl.exe'
Image|endswith: '\excel.exe'
Image|endswith: '\finger.exe'
Image|endswith: '\hh.exe'
Image|endswith: '\msaccess.exe'
Image|endswith: '\mshta.exe'
Image|endswith: '\mspub.exe'
Image|endswith: '\notepad.exe'
Image|endswith: '\powerpnt.exe'
Image|endswith: '\visio.exe'
Image|endswith: '\winword.exe'
Image|endswith: '\wordpad.exe'
Image|endswith: '\wordview.exe'
or:
TargetFilename|endswith: .7z
TargetFilename|endswith: .appx
TargetFilename|endswith: .diagcab
TargetFilename|endswith: .rar
TargetFilename|endswith: .zip

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.