Query: detect Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensit in logs
Matching passage: Sigma rule: Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensit. Logsource: windows / process_creation. Rule: title: Files Added To An Archive Using Rar.EXE id: 6f3e2987-db24-4c78-a860-b4f4095a7095 status: test description: Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md - https://eqllib.readthedocs.io/en/latest/analytics/1ec33c93-3d0b-4a28-8014-dbdaae5c60ae.html author: Timur Zinniatullin, E.M. Anhaus, oscd.community date: 2019-10-21 modified: 2023-02-05 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \rar.exe CommandLine|contains: ' a ' condition: selection falsepositives: - Highly likely if rar is a default archiver in the monitored environment. level: low
Near-miss passage: Sigma rule: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName data. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Via Rename Of Highly Relevant Binaries id: 0ba1da6d-b6ce-4366-828c-18826c9de23e related: - id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142 type: similar - id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed type: derived - id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2 type: obsolete - id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20 type: obsolete - id: d4d2574f-ac17-4d9e-b986-aeeae0dc8fe2 type: obsolete status: test description: Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint. references: - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks - https://twitter.com/christophetd/status/1164506034720952320 - https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/ - https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke author: Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113 date: 2019-06-15 modified: 2026-06-29 tags: - attack.stealth - attack.t1036.003 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection: - Description: Execute processes remotely - Product: Sysinternals PsExec - Description|startswith: - Windows PowerShell - pwsh - OriginalFileName: - certutil.exe - cmstp.exe - cscript.exe - IE4UINIT.EXE - finger.exe - mshta.exe - msiexec.exe - msxsl.exe - powershell_ise.exe - powershell.exe - psexec.c - psexec.exe - psexesvc.exe - pwsh.dll - reg.exe - regsvr32.exe - rundll32.exe - WerMgr - wmic.exe - wscript.exe filter: Image|endswith: - \certutil.exe - \cmstp.exe - \cscript.exe - \ie4uinit.exe - \finger.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \powershell_ise.exe - \powershell.exe - \psexec.exe - \psexec64.exe - \psexec64a.exe - \PSEXESVC.exe - \pwsh.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \wermgr.exe - \wmic.exe - \wscript.exe condition: selection and not filter falsepositives: - Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist - PsExec installed via Windows Store doesn't contain original filename field (False negative) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant/info.yml