Detectionmediumtest
Suspicious ZipExec Execution
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
run:
CommandLine|contains|all:
- '/generic:Microsoft_Windows_Shell_ZipFolder:filename='
- '.zip'
- '/pass:'
- '/user:'
delete:
CommandLine|contains|all:
- '/delete'
- 'Microsoft_Windows_Shell_ZipFolder:filename='
- '.zip'
condition: run or deleteFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Rule Metadata
Rule ID
90dcf730-1b71-4ae7-9ffc-6fcf62bd0132
Status
test
Level
medium
Type
Detection
Created
Sun Nov 07
Modified
Sun Dec 25
Author
Path
rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml
Raw Tags
attack.executionattack.defense-evasionattack.t1218attack.t1202