Detection rules › Sigma

Suspicious Extrac32 Execution

Severity
medium
Author
frack113
Source
upstream

Download or Copy file with Extrac32

MITRE ATT&CK coverage

TacticTechniques
Command & ControlT1105 Ingress Tool Transfer

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_lolbas

or:
CommandLine|contains: extrac32.exe
Image|endswith: '\extrac32.exe'
OriginalFileName: extrac32.exe

Stage 2: all of selection_archive

CommandLine|contains: .cab

Stage 3: all of selection_options

or:
CommandLine|contains: ' \\\\'
CommandLine|contains: '/C'
CommandLine|contains: '/Y'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • \\\\ corpus 8 (sigma 8)
  • .cab corpus 5 (sigma 5)
  • /C corpus 3 (sigma 3)
  • /Y
  • extrac32.exe corpus 2 (sigma 2)
Imageends_with
  • \extrac32.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • extrac32.exe