Title:Password Protected ZIP File Opened (Email Attachment) Status:test Description:Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. References: -https://twitter.com/sbousseaden/status/1523383197513379841 Author: Florian Roth (Nextron Systems) Date: 2022-05-09 modified:None Tags:
-'attack.initial-access'
-'attack.stealth'
-'attack.t1027'
-'attack.t1566.001'
Logsource:
product: windows
service: security
Detection: selection: EventID:
'5379' TargetName|contains|all: -'Microsoft_Windows_Shell_ZipFolder:filename' -'\Temporary Internet Files\Content.Outlook'
condition:selection Falsepositives:
-Legitimate used of encrypted ZIP files Level:high
