AN0831
Analytic 0831
Windows
Detects adversarial archiving using built-in or third-party utilities (makecab, diantz, xcopy, certutil, 7z, WinRAR, WinZip). Correlates suspicious process creation events with command-line arguments for compression/encoding, followed by creation of archive files (.cab, .zip, .7z, .rar). Identifies anomalous loading of crypt32.dll for encryption operations or execution of diantz.exe to compress remotely staged files.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=7
[SuspiciousExtensions]
List of archive extensions considered high risk (.cab, .zip, .7z, .rar).
[ProcessAllowlist]
Known business utilities allowed to create archives without alerting.
[FileSizeThresholdMB]
Minimum archive size threshold to filter out benign small compressions.
AN0832
Analytic 0832
Linux
Detects execution of archiving utilities (tar, gzip, bzip2, xz, zip, openssl) followed by suspicious archive file creation. Correlates archive creation in temporary or staging directories with execution of commands involving compression or encryption options.
auditd:SYSCALL
execve: Execution of tar, gzip, bzip2, xz, zip, or openssl with compression/encryption arguments
auditd:FILE
create: Creation of archive files in /tmp, /var/tmp, or user home directories
[ArchiveCommands]
List of archiving utilities considered suspicious.
[MonitoredDirectories]
Paths where archive creation is flagged as unusual (e.g., /tmp, /var/tmp).
[TimeWindow]
Correlation window for linking utility execution with archive creation.
AN0833
Analytic 0833
macOS
Detects invocation of macOS-native archiving utilities (zip, ditto, hdiutil) or openssl used for encryption. Correlates execution with archive or encrypted file creation (.zip, .dmg, .tar.gz) in user or temporary directories. Identifies anomalous use of archiving commands by Office applications or daemons.
macos:unifiedlog
Execution of zip, ditto, hdiutil, or openssl by processes not normally associated with archiving
macos:unifiedlog
Creation of .zip, .dmg, .tar.gz files in /Users, /tmp, or application directories
[AllowedArchivers]
Business-approved applications permitted to create archives (e.g., backup agents).
[UserContext]
Flag archiving under privileged or service accounts as higher risk.
[PayloadEntropyThreshold]
Entropy threshold for detecting encrypted archives versus normal compression.