Elastic low stable eql

Archive File with Unusual Extension

Identifies the creation of an archive file with an unusual extension. Attackers may attempt to evade detection by masquerading files using the file extension values used by image, audio, or document file types.

View Source

Detection Logic

file where host.os.type == "windows" and event.action != "deletion" and

  /* common archive file headers - Rar, 7z, GZIP, MSCF, XZ, ZIP */
  file.Ext.header_bytes : ("52617221*", "377ABCAF271C*", "1F8B*", "4d534346*", "FD377A585A00*", "504B0304*", "504B0708*") and

  (
    /* common image file extensions */
    file.extension : ("jpg", "jpeg", "emf", "tiff", "gif", "png", "bmp", "ico", "fpx", "eps", "inf") or

    /* common audio and video file extensions */
    file.extension : ("mp3", "wav", "avi", "mpeg", "flv", "wma", "wmv", "mov", "mp4", "3gp") or

    /* common document file extensions */
    (file.extension : ("doc", "docx", "rtf", "ppt", "pptx", "xls", "xlsx") and

    /* exclude ZIP file header values for OPENXML documents */
    not file.Ext.header_bytes : ("504B0304*", "504B0708*"))
  ) and

  not (process.executable : "?:\\Windows\\System32\\inetsrv\\w3wp.exe" and file.path : "?:\\inetpub\\temp\\IIS Temporary Compressed Files\\*")

Field Validations

Loading…

Comments (0)

Loading comments...