Password Protected ZIP File Opened
Detects when a password-protected ZIP archive is opened or extracted on a Windows system. This is identified by EventID 5379 from the Security log, specifically looking for 'Microsoft_Windows_Shell_ZipFolder:filename' in the TargetName field. The rule filters out events originating from ' Temporary Internet Files\Content.Outlook' to reduce false positives.
Sigma
