Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Password Protected ZIP File Opened (Email Attachment)

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Mon May 09571498c8-908e-40b4-910b-d2369159a3dawindows
Log Source
Windowssecurity
ProductWindows← raw: windows
Servicesecurity← raw: security
Detection Logic
Detection Logic1 selector
detection:
    selection:
        EventID: 5379
        TargetName|contains|all:
            - 'Microsoft_Windows_Shell_ZipFolder:filename'
            - '\Temporary Internet Files\Content.Outlook'
    condition: selection
False Positives

Legitimate used of encrypted ZIP files

References
1
Resolving title…
twitter.com
MITRE ATT&CK
Rule Metadata
Rule ID
571498c8-908e-40b4-910b-d2369159a3da
Status
test
Level
high
Type
Detection
Created
Mon May 09
Author
Florian Roth (Nextron Systems)
Path
rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml
Raw Tags
attack.defense-evasionattack.initial-accessattack.t1027attack.t1566.001
View on GitHub