rules/windows/powershell/powershell_module/powershell_susp_zip_compress.yml

title: Zip A Folder With PowerShell For Staging In Temp
id: daf7eb81-35fd-410d-9d7a-657837e602bb
related:
    - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9
      type: derived
status: experimental
author: frack113
date: 2021/07/20
modified: 2021/10/16
description: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1074.001/T1074.001.md
tags:
    - attack.collection
    - attack.t1074.001
logsource:
    product: windows
    category: ps_module
    definition: PowerShell Module Logging must be enabledd
detection:
    selection_4103:
        ContextInfo|contains|all:
            - 'Compress-Archive '
            - ' -Path '
            - ' -DestinationPath '
            - '$env:TEMP\'
    condition: selection_4103
falsepositives:
    - Unknown
level: medium
$frack113$ add win_susp_zip_compress.yml 2021-07-20 13:13:53 +02:00			`title: Zip A Folder With PowerShell For Staging In Temp`
$frack113$ order powershell_module 2021-10-09 09:50:49 +02:00			`id: daf7eb81-35fd-410d-9d7a-657837e602bb`
			`related:`
			`- id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9`
$frack113$ order powershell_script 2021-10-09 10:30:36 +02:00			`type: derived`
$frack113$ add win_susp_zip_compress.yml 2021-07-20 13:13:53 +02:00			`status: experimental`
			`author: frack113`
			`date: 2021/07/20`
$frack113$ Change to category: ps_module 2021-10-16 08:05:15 +02:00			`modified: 2021/10/16`
$frack113$ add win_susp_zip_compress.yml 2021-07-20 13:13:53 +02:00			`description: Use living off the land tools to zip a file and stage it in the Windows temporary folder for later exfiltration`
			`references:`
			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1074.001/T1074.001.md`
			`tags:`
			`- attack.collection`
			`- attack.t1074.001`
			`logsource:`
			`product: windows`
$frack113$ Change to category: ps_module 2021-10-16 08:05:15 +02:00			`category: ps_module`
docs: extended the description by a word 2021-10-09 16:42:42 +02:00			`definition: PowerShell Module Logging must be enabledd`
$frack113$ add win_susp_zip_compress.yml 2021-07-20 13:13:53 +02:00			`detection:`
$frack113$ add 4104 2021-09-30 10:03:11 +02:00			`selection_4103:`
$frack113$ add win_susp_zip_compress.yml 2021-07-20 13:13:53 +02:00			`ContextInfo\|contains\|all:`
			`- 'Compress-Archive '`
			`- ' -Path '`
			`- ' -DestinationPath '`
			`- '$env:TEMP\'`
$frack113$ order powershell_module 2021-10-09 09:50:49 +02:00			`condition: selection_4103`
$frack113$ Split global rules 2021-09-07 13:30:32 +02:00			`falsepositives:`
			`- Unknown`
			`level: medium`