rules/windows/powershell/powershell_script/powershell_data_compressed.yml

title: Data Compressed - PowerShell
id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a
status: experimental
description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
author: Timur Zinniatullin, oscd.community
date: 2019/10/21
modified: 2021/07/06
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560/T1560.md
logsource:
    product: windows
    service: powershell
    definition: Script block logging must be enabled
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains|all:
            - '-Recurse'
            - '|'
            - 'Compress-Archive'
    condition: selection
falsepositives:
    - Highly likely if archive operations are done via PowerShell.
level: low
tags:
    - attack.exfiltration
    - attack.t1560
    - attack.t1002  # an old one
Update powershell_data_compressed.yml 2021-07-03 20:48:03 +08:00			`title: Data Compressed - PowerShell`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 6dc5d284-69ea-42cf-9311-fb1c3932a69a`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`status: experimental`
Update powershell_data_compressed.yml 2021-07-03 20:48:03 +08:00			`description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`author: Timur Zinniatullin, oscd.community`
			`date: 2019/10/21`
Insert modified date 2021-07-06 20:56:31 +08:00			`modified: 2021/07/06`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`references:`
Update powershell_data_compressed.yml 2021-07-04 08:15:29 +08:00			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560/T1560.md`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`logsource:`
			`product: windows`
			`service: powershell`
$frack113$ Cleanup PS rules 2021-08-21 09:58:58 +02:00			`definition: Script block logging must be enabled`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`detection:`
			`selection:`
			`EventID: 4104`
powershell_data_compressed.yml - Update selection 2021-07-06 20:36:38 +08:00			`ScriptBlockText\|contains\|all:`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`- '-Recurse'`
			`- '\|'`
			`- 'Compress-Archive'`
			`condition: selection`
			`falsepositives:`
Update powershell_data_compressed.yml 2021-07-03 20:48:03 +08:00			`- Highly likely if archive operations are done via PowerShell.`
Unified line terminators of rules to Unix 2019-11-12 23:05:36 +01:00			`level: low`
			`tags:`
			`- attack.exfiltration`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`- attack.t1560`
windows/powershell folder reviewed. Old ID’s marked with comment “an old one”. These ID’s have to be removed in future. 2020-08-24 00:01:50 +00:00			`- attack.t1002 # an old one`