Windows Executable Process Dropping Archive Files (.zip/.rar/.7z/.cab/.appx)

title: Windows Executable Process Dropping Archive Files (.zip/.rar/.7z/.cab/.appx)
id: e9cba057-ff98-41e2-966c-bf2db0c3d198
status: test
description: This rule flags Windows file creation events where specific legitimate executables write archive file types to disk, including .zip, .rar, .7z, .diagcab, and .appx. Attackers may abuse otherwise trusted programs to stage payloads, bundle malicious content, or facilitate execution by packaging artifacts. Detection relies on process image name matching for the spawning executable and the target filename extension observed in file event telemetry.
references:
  - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml
author: frack113, Florian Roth, Huntrule Team
date: 2022-08-21
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \winword.exe
      - \excel.exe
      - \powerpnt.exe
      - \msaccess.exe
      - \mspub.exe
      - \eqnedt32.exe
      - \visio.exe
      - \wordpad.exe
      - \wordview.exe
      - \certutil.exe
      - \certoc.exe
      - \CertReq.exe
      - \Desktopimgdownldr.exe
      - \esentutl.exe
      - \finger.exe
      - \notepad.exe
      - \AcroRd32.exe
      - \RdrCEF.exe
      - \mshta.exe
      - \hh.exe
    TargetFilename|endswith:
      - .zip
      - .rar
      - .7z
      - .diagcab
      - .appx
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 654fcc6d-840d-4844-9b07-2c3300e54a26
    type: derived