huntrule

Windows Security Event 5379: Password-Protected ZIP Opened

Flags Windows EventID 5379 indicating a password-protected ZIP archive was opened.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-05-09
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies when Windows reports opening an encrypted, password-protected ZIP archive via Shell ZIP folder activity. Attackers may use password-protected archives to delay analysis and hinder casual inspection, especially during delivery or staging. It relies on Windows Security log EventID 5379 and matching the TargetName field content for the ZIP folder filename indicator, with an exclusion for temporary Outlook content.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Suspicious Python Interpreter Launching Encoded PowerShell via subprocess
Suspicious PowerShell Download Of Text-Disguised Payload
Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)
Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)
Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)
Suspicious Hidden PowerShell Executing Substring of Dropped File
PowerShell Encoded or Download-Cradle Command Line (via process_creation)
Windows Security Event 5379: Password-Protected ZIP Opened
Pivot detection · T1027 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.