Suspicious Compression Tool Parameters for Data Archiving
This rule detects potentially suspicious command-line arguments used with common data compression tools like 7-Zip and WinRAR. The presence of parameters such as '-p' (password), '-hp' (header password), '-sdel' (secure delete after archiving), '-ta', '-tb', and '-dw' can indicate an adversary's attempt to archive collected data, potentially encrypt it, and then remove the original files to cover their tracks. This behavior is often observed during the collection and staging phases of an attack, prior to exfiltration. The rule includes a filter to reduce false positives by excluding processes launched from standard program file paths.
Sigma
