WinZip Used to Compress and Password Protect Data

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects the use of WinZip (winzip.exe or winzip64.exe) to compress and password-protect data. This activity is often associated with adversaries preparing data for exfiltration, as it allows them to package and secure collected information. The rule specifically looks for command-line arguments indicating the use of WinZip along with a password option and common archiving flags.