Detection rules › Sigma
Password Protected ZIP File Opened (Suspicious Filenames)
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1027 Obfuscated Files or Information, T1036 Masquerading |
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 5379 | Credential Manager credentials were read. |
Stages and Predicates
Stage 1: selection
TargetName|contains: 'Microsoft_Windows_Shell_ZipFolder:filename'
Stage 2: selection_filename
or:
TargetName|contains: delivery
TargetName|contains: factura
TargetName|contains: invoice
TargetName|contains: 'new order'
TargetName|contains: order
TargetName|contains: payment
TargetName|contains: purchase
TargetName|contains: rechnung
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
TargetName | match |
|
Neighbors
Stricter alternatives (narrower than this rule)
The rules below may be useful if you find the current rule is too noisy / lacks specificity.
- Password Protected ZIP File Opened (Email Attachment) (adds 1 filter)