sublimemediumRule

Attachment: 7z Archive Containing RAR File

Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          and .file_type == "7z"
        )
        and any(file.expand_archives(.).files, .file_type == "rar")
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Attachment: 7z Archive Containing RAR File"
description: "Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats."
type: "rule"
severity: "medium"
source: |
    type.inbound
    and any(attachments,
            (
              .file_extension in~ $file_extensions_common_archives
              and .file_type == "7z"
            )
            and any(file.expand_archives(.).files, .file_type == "rar")
    )
tags:
 - "Attack surface reduction"
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "Archive analysis"
  - "File analysis"
id: "1a629bb4-931a-5395-bf22-da327d224d3c"