huntrule

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Flags Windows processes running ZipFolder zip commands with password and .zip filename parameters, optionally including deletion.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2021-11-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process creation commands consistent with ZipExec usage, specifically invoking the Microsoft Windows Shell ZipFolder filename option while supplying ZIP password and user parameters. Attackers can use this technique to stealthily deliver or execute packaged binaries from password-protected ZIP containers. Telemetry required includes Windows process creation events with a populated CommandLine field.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange
Windows ConHost Spawning Suspicious Script and Command-Line Child Processes
Suspicious Child Process Creation from BgInfo.EXE on Windows
Windows: Suspicious Child Process Spawned by VsCode code.exe
Windows WSL Process Spawning Uncommon Child Executables
Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables
Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable
Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags
Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution
Windows renamed dctask64.exe execution via known IMPHASH values
Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP
Pivot detection · T1202 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.