EXPLORE
Sign In
← Back to Explore
sigmahighHunting

Password Protected ZIP File Opened (Email Attachment)

Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

MITRE ATT&CK

T1027T1566.001
defense-evasioninitial-access

Detection Query

selection:
  EventID: 5379
  TargetName|contains|all:
    - Microsoft_Windows_Shell_ZipFolder:filename
    - \Temporary Internet Files\Content.Outlook
condition: selection

Author

Florian Roth (Nextron Systems)

Created

2022-05-09

Data Sources

windowssecurity

Platforms

windows

References

Tags

attack.defense-evasionattack.initial-accessattack.t1027attack.t1566.001
Raw Content
title: Password Protected ZIP File Opened (Email Attachment)
id: 571498c8-908e-40b4-910b-d2369159a3da
status: test
description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
references:
    - https://twitter.com/sbousseaden/status/1523383197513379841
author: Florian Roth (Nextron Systems)
date: 2022-05-09
tags:
    - attack.defense-evasion
    - attack.initial-access
    - attack.t1027
    - attack.t1566.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5379
        TargetName|contains|all:
            - 'Microsoft_Windows_Shell_ZipFolder:filename'
            - '\Temporary Internet Files\Content.Outlook'
    condition: selection
falsepositives:
    - Legitimate used of encrypted ZIP files
level: high