Windows Process Creation: Suspicious Command-Line Parameters for 7z and RAR Compression Tools

title: "Windows Process Creation: Suspicious Command-Line Parameters for 7z and RAR Compression Tools"
id: 60d5259a-af18-42be-ac11-c528243fbb78
status: test
description: This rule flags Windows processes where 7z/rar-related executables are launched with command-line options commonly associated with hiding or manipulating compressed output, such as password or deletion flags. Attackers can use compression tooling to package files for exfiltration, persistence staging, or to reduce visibility of collected data. The detection relies on process creation telemetry, specifically OriginalFileName and the presence of targeted switches in the CommandLine, while excluding cases where the parent process path indicates typical installation directories.
references:
  - https://twitter.com/SBousseaden/status/1184067445612535811
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_compression_params.yml
author: Florian Roth (Nextron Systems), Samir Bousseaden, Huntrule Team
date: 2019-10-15
modified: 2023-08-29
tags:
  - attack.collection
  - attack.t1560.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName:
      - 7z*.exe
      - "*rar.exe"
      - "*Command*Line*RAR*"
    CommandLine|contains:
      - " -p"
      - " -ta"
      - " -tb"
      - " -sdel"
      - " -dw"
      - " -hp"
  filter_main_generic:
    ParentImage|contains:
      - :\Program Files\
      - :\Program Files (x86)\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 27a72a60-7e5e-47b1-9d17-909c9abafdcd
    type: derived