Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Flags Windows processes running ZipFolder zip commands with password and .zip filename parameters, optionally including deletion.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-11-07
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation commands consistent with ZipExec usage, specifically invoking the Microsoft Windows Shell ZipFolder filename option while supplying ZIP password and user parameters. Attackers can use this technique to stealthily deliver or execute packaged binaries from password-protected ZIP containers. Telemetry required includes Windows process creation events with a populated CommandLine field.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows: Suspicious Child Process Spawned by VsCode code.exe

Windows WSL Process Spawning Uncommon Child Executables

Windows: Alert on Unusual Child Process of Setres.EXE Spawning 'choice' Executables

Windows Process Creation: Detect Sysinternals Tool Name Impersonation by Executable

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution

Windows renamed dctask64.exe execution via known IMPHASH values

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Pivot detection · T1202 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-suspicious-zipexec-style-password-protected-zip-executi-90dcf730

title: Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP
id: 543bbe98-4fec-41a6-8a05-85276c6552ca
status: test
description: This rule identifies process creation commands consistent with ZipExec usage, specifically invoking the Microsoft Windows Shell ZipFolder filename option while supplying ZIP password and user parameters. Attackers can use this technique to stealthily deliver or execute packaged binaries from password-protected ZIP containers. Telemetry required includes Windows process creation events with a populated CommandLine field.
references:
  - https://twitter.com/SBousseaden/status/1451237393017839616
  - https://github.com/Tylous/ZipExec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml
author: frack113, Huntrule Team
date: 2021-11-07
modified: 2022-12-25
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  run:
    CommandLine|contains|all:
      - /generic:Microsoft_Windows_Shell_ZipFolder:filename=
      - .zip
      - "/pass:"
      - "/user:"
  delete:
    CommandLine|contains|all:
      - /delete
      - Microsoft_Windows_Shell_ZipFolder:filename=
      - .zip
  condition: run or delete
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 90dcf730-1b71-4ae7-9ffc-6fcf62bd0132
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL