Windows Process Creation: Suspicious ZipExec-style Password-Protected Zip Execution

Flags Windows processes running ZipFolder zip commands with password and .zip filename parameters, optionally including deletion.

FreeUnreviewedSigmamediumv1

windows-process-creation-suspicious-zipexec-style-password-protected-zip-executi-90dcf730

title: "Windows Process Creation: Suspicious ZipExec-style Password-Protected Zip Execution"
id: 543bbe98-4fec-41a6-8a05-85276c6552ca
status: test
description: This rule identifies Windows process executions with command-line parameters consistent with ZipExec, specifically creating or modifying password-protected zip archives using Shell ZipFolder settings. Attackers can use this to package and deliver binaries while adding a password layer to hinder casual inspection and delay analysis. The detection relies on process creation telemetry, matching specific command-line substrings for .zip targeting, password arguments (/pass:), and ZipFolder filename usage, with an optional zip deletion action (/delete).
references:
  - https://twitter.com/SBousseaden/status/1451237393017839616
  - https://github.com/Tylous/ZipExec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml
author: frack113, Huntrule Team
date: 2021-11-07
modified: 2022-12-25
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  run:
    CommandLine|contains|all:
      - /generic:Microsoft_Windows_Shell_ZipFolder:filename=
      - .zip
      - "/pass:"
      - "/user:"
  delete:
    CommandLine|contains|all:
      - /delete
      - Microsoft_Windows_Shell_ZipFolder:filename=
      - .zip
  condition: run or delete
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 90dcf730-1b71-4ae7-9ffc-6fcf62bd0132
    type: derived

What it detects

This rule identifies Windows process executions with command-line parameters consistent with ZipExec, specifically creating or modifying password-protected zip archives using Shell ZipFolder settings. Attackers can use this to package and deliver binaries while adding a password layer to hinder casual inspection and delay analysis. The detection relies on process creation telemetry, matching specific command-line substrings for .zip targeting, password arguments (/pass:), and ZipFolder filename usage, with an optional zip deletion action (/delete).

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.