SEKOIA.IO Rules medium stable sigma

Data Compressed With Rar With Password

An adversary may compress data in order to make it portable and minimize the amount of data sent over the network, this could be done the popular rar command line program. This is a more specific one for rar where the arguments allow to encrypt both file data and headers with a given password.

View Source

Detection Logic

cmd:
  process.command_line
| contains
| all:
    - " a "
    - " -hp"
powershell:
  action.properties.ScriptBlockText
| contains
| all:
    - rar.exe
    - " a "
    - " -hp"
condition: cmd or powershell

Field Validations

Loading…

Comments (0)

Loading comments...