Windows: WinZip executed with password flag and archive parameters indicative of data staging

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1560.001Archive via Utility
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process executions where WinZip or WinZip64 is run with command-line components consistent with password protection and archive creation parameters. Adversaries commonly compress and encrypt data before exfiltration to reduce size and hinder analysis by the defender. The detection relies on process creation telemetry and inspects the command line for winzip binaries, a password-related flag pattern, and additional archive options.

Reporting behind it

Related detections9 linkedT1560.001 — drag to rearrange

Data Collection via Rar Archiving With Recursion and Compression Flags

Suspicious Archiving of Registry Hives via WinRAR (UAT-8099)

Suspicious Data Staging via Password-Protected Archive Utility (via process_creation)

Suspicious Archive Staged in Web Accessible Directory via tar

Suspicious Archive Staged in Web Root via tar on Ivanti EPMM

Suspicious Payload Staging in Public Libraries Directory via file_event

Suspicious macOS Data Staging via ditto to Temp Archive in Attacker Directory (via process_creation)

Suspicious WinRAR Silent Archive Staging

Suspicious VOLTZITE Single-Character Named ZIP Exfil Staging (via file_event)

Windows: WinZip executed with password flag and archive parameters indicative of data staging

Pivot detection · T1560.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winzip-executed-with-password-flag-and-archive-parameters-indicative-of--e2e80da2

title: "Windows: WinZip executed with password flag and archive parameters indicative of data staging"
id: 6d7fb205-b2ea-48bc-a7b9-ce91adf9d5fc
status: test
description: This rule identifies Windows process executions where WinZip or WinZip64 is run with command-line components consistent with password protection and archive creation parameters. Adversaries commonly compress and encrypt data before exfiltration to reduce size and hinder analysis by the defender. The detection relies on process creation telemetry and inspects the command line for winzip binaries, a password-related flag pattern, and additional archive options.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winzip_password_compression.yml
author: frack113, Huntrule Team
date: 2021-07-27
modified: 2022-12-25
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_winzip:
    CommandLine|contains:
      - winzip.exe
      - winzip64.exe
  selection_password:
    CommandLine|contains: -s"
  selection_other:
    CommandLine|contains:
      - " -min "
      - " -a "
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL