Windows Security: Password-Protected ZIP Opened (EventID 5379)

Flags Windows EventID 5379 indicating a password-protected ZIP archive was opened.

FreeUnreviewedSigmamediumv1

windows-security-password-protected-zip-opened-eventid-5379-00ba9da1

title: "Windows Security: Password-Protected ZIP Opened (EventID 5379)"
id: 462e175e-b16a-44e9-bc41-6e379416fc23
status: test
description: This rule identifies when Windows opens a password-protected ZIP file, indicated by Security EventID 5379 with a Shell ZipFolder filename target. Attackers often use encrypted archives to delay inspection and evade detection while delivering staged content. The detection relies on Windows Security logging and specifically matches the TargetName field that contains the ZIP folder filename marker.
references:
  - https://twitter.com/sbousseaden/status/1523383197513379841
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-09
tags:
  - attack.stealth
  - attack.t1027
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5379
    TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename
  filter:
    TargetName|contains: \Temporary Internet Files\Content.Outlook
  condition: selection and not filter
falsepositives:
  - Legitimate used of encrypted ZIP files
level: medium
license: DRL-1.1
related:
  - id: 00ba9da1-b510-4f6b-b258-8d338836180f
    type: derived

What it detects

This rule identifies when Windows opens a password-protected ZIP file, indicated by Security EventID 5379 with a Shell ZipFolder filename target. Attackers often use encrypted archives to delay inspection and evade detection while delivering staged content. The detection relies on Windows Security logging and specifically matches the TargetName field that contains the ZIP folder filename marker.

Known false positives

Legitimate used of encrypted ZIP files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.