Suspicious ZipExec Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the execution of ZipExec, a Proof-of-Concept (POC) tool designed to wrap binary-based tools into a password-protected zip file. It specifically looks for command-line arguments indicative of ZipExec's 'run' functionality (extracting and executing a zip file with a password) or 'delete' functionality (deleting the extracted files). The detection relies on specific strings like '/generic:Microsoft_Windows_Shell_ZipFolder:filename=', '.zip', '/pass:', '/user:' for 'run' operations, and '/delete', 'Microsoft_Windows_Shell_ZipFolder:filename=', '.zip' for 'delete' operations.