AN0782
Analytic 0782
Windows
Monitors for compression tool usage (e.g., 7zip, WinRAR, MakeCab) that follows or precedes file modification, suspicious file types (e.g., .exe, .dll) being compressed, or dropped from self-extracting archives followed by immediate execution.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
[CompressedFileType]
Zip, .rar, .cab, .gz – tune based on expected legitimate use of compression in environment
[SFXExecutionDelay]
Expected time between archive unpacking and first execution – short delays are suspicious
[UserContext]
Restrict detection to non-admin or interactive users if excessive FPs from sys admin activity
AN0783
Analytic 0783
Linux
Detects sequential command-line compression utilities (e.g., gzip, tar, zip, 7z) followed by execution of unpacked files, especially in temp directories or under non-standard locations like /dev/shm or /tmp with ELF binaries.
auditd:SYSCALL
execve
auditd:SYSCALL
write
auditd:SYSCALL
openat
auditd:SYSCALL
chmod
[PathRegex]
Flag compressed archives extracted to /tmp, /dev/shm, or user’s home dir
[CompressionToolPatterns]
gzip, tar, bzip2, xz, 7z – tune to suppress admin packaging workflows
[ExecutionAfterUnpackWindow]
How soon a new file is executed after it’s unpacked
AN0784
Analytic 0784
macOS
Identifies archive utilities (e.g., ditto, unzip, xar, pkgutil) used to extract payloads to non-standard paths, then correlates with execution or file permission changes (e.g., `chmod +x`) and process spawns from decompressed location.
macos:unifiedlog
Process launch
macos:unifiedlog
filesystem events
fs:fsusage
file open/write
[DecompressionPathMatch]
Target unusual extraction paths (~/Library/, /tmp/, /private/tmp/)
[ToolBinaryNames]
List of decompression utilities used in the environment
[FollowOnExecutionDelta]
Time between decompression and first binary execution