Windows: WinZip executed with password flag and archive parameters indicative of data staging

title: "Windows: WinZip executed with password flag and archive parameters indicative of data staging"
id: 6d7fb205-b2ea-48bc-a7b9-ce91adf9d5fc
status: test
description: This rule identifies Windows process executions where WinZip or WinZip64 is run with command-line components consistent with password protection and archive creation parameters. Adversaries commonly compress and encrypt data before exfiltration to reduce size and hinder analysis by the defender. The detection relies on process creation telemetry and inspects the command line for winzip binaries, a password-related flag pattern, and additional archive options.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winzip_password_compression.yml
author: frack113, Huntrule Team
date: 2021-07-27
modified: 2022-12-25
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_winzip:
    CommandLine|contains:
      - winzip.exe
      - winzip64.exe
  selection_password:
    CommandLine|contains: -s"
  selection_other:
    CommandLine|contains:
      - " -min "
      - " -a "
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d
    type: derived