Windows Security: Password-Protected ZIP Opened from Outlook Attachment

Flags Windows events where a password-protected ZIP is opened from Outlook Temporary Internet Files.

FreeUnreviewedSigmahighv1

windows-security-password-protected-zip-opened-from-outlook-attachment-571498c8

title: "Windows Security: Password-Protected ZIP Opened from Outlook Attachment"
id: 1d03ecde-dc38-454f-b547-88d12bc2da5f
status: test
description: This rule identifies when Windows security logs show opening of a password-protected ZIP (ZipFolder) whose file path includes an Outlook Temporary Internet Files location. Attackers commonly use encrypted archives to evade inspection while still delivering and triggering execution by opening the container. It relies on Windows Security Event ID 5379 data that includes the ZipFolder filename and the affected directory path.
references:
  - https://twitter.com/sbousseaden/status/1523383197513379841
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-09
tags:
  - attack.initial-access
  - attack.stealth
  - attack.t1027
  - attack.t1566.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5379
    TargetName|contains|all:
      - Microsoft_Windows_Shell_ZipFolder:filename
      - \Temporary Internet Files\Content.Outlook
  condition: selection
falsepositives:
  - Legitimate used of encrypted ZIP files
level: high
license: DRL-1.1
related:
  - id: 571498c8-908e-40b4-910b-d2369159a3da
    type: derived

What it detects

This rule identifies when Windows security logs show opening of a password-protected ZIP (ZipFolder) whose file path includes an Outlook Temporary Internet Files location. Attackers commonly use encrypted archives to evade inspection while still delivering and triggering execution by opening the container. It relies on Windows Security Event ID 5379 data that includes the ZipFolder filename and the affected directory path.

Known false positives

Legitimate used of encrypted ZIP files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.