Windows Security: Opened Encrypted ZIP Files with Suspicious Invoice/Order Filenames

Alerts when Windows opens password-protected ZIP contents with filenames commonly tied to invoices, orders, payments, and deliveries.

FreeUnreviewedSigmahighv1

windows-security-opened-encrypted-zip-files-with-suspicious-invoice-order-filena-54f0434b

title: "Windows Security: Opened Encrypted ZIP Files with Suspicious Invoice/Order Filenames"
id: 5bed0aec-d052-47ff-ae96-e40c057fe63b
status: test
description: This rule flags Windows security events indicating that a password-protected ZIP archive was opened and its contents had suspicious, business-themed filenames such as invoice, order, payment, delivery, purchase, and translations. Attackers may use encrypted archives to bypass casual inspection and deliver lure files for command-and-control or follow-on execution. It relies on Windows Security event telemetry (EventID 5379) and the event TargetName string containing both the ZIPFolder filename and one of the listed suspicious filename terms.
references:
  - https://twitter.com/sbousseaden/status/1523383197513379841
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-09
tags:
  - attack.command-and-control
  - attack.stealth
  - attack.t1027
  - attack.t1105
  - attack.t1036
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5379
    TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename
  selection_filename:
    TargetName|contains:
      - invoice
      - new order
      - rechnung
      - factura
      - delivery
      - purchase
      - order
      - payment
  condition: selection and selection_filename
falsepositives:
  - Legitimate used of encrypted ZIP files
level: high
license: DRL-1.1
related:
  - id: 54f0434b-726f-48a1-b2aa-067df14516e4
    type: derived

What it detects

This rule flags Windows security events indicating that a password-protected ZIP archive was opened and its contents had suspicious, business-themed filenames such as invoice, order, payment, delivery, purchase, and translations. Attackers may use encrypted archives to bypass casual inspection and deliver lure files for command-and-control or follow-on execution. It relies on Windows Security event telemetry (EventID 5379) and the event TargetName string containing both the ZIPFolder filename and one of the listed suspicious filename terms.

Known false positives

Legitimate used of encrypted ZIP files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.