Detect Compression in Google Chronicle

rule t1027_015_compression_suspicious_extraction {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects suspicious archive extraction to staging paths, PowerShell decompression, and archive delivery via browser or email — T1027.015 Obfuscated Files: Compression"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1027.015"
    severity = "MEDIUM"
    priority = "MEDIUM"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname

    (
      // Archive tool extracting to suspicious staging paths
      (
        re.regex($e.target.process.file.full_path, `(?i)(7z|7za|7zr|winrar|unrar)\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)( x | e | t )`)
        and re.regex($e.target.process.command_line, `(?i)(\\Temp\\|AppData|ProgramData|Users\\Public)`)
      )
      or
      // PowerShell GZip/Deflate in-memory decompress
      (
        re.regex($e.target.process.file.full_path, `(?i)powershell\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)(GZipStream|DeflateStream|IO\.Compression|System\.IO\.Compression)`)
      )
      or
      // PowerShell Expand-Archive to staging path
      (
        re.regex($e.target.process.file.full_path, `(?i)powershell\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)(Expand-Archive|ExtractToDirectory|Extract\(\))`)
        and re.regex($e.target.process.command_line, `(?i)(\\Temp\\|AppData|ProgramData)`)
      )
    )

  condition:
    $e
}

rule t1027_015_archive_delivered_browser_email {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects archive files created in download/temp paths by browser or email client processes — T1027.015"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1027.015"
    severity = "MEDIUM"
    priority = "MEDIUM"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    $e.principal.hostname = $hostname

    re.regex($e.target.file.full_path, `(?i)\.(zip|rar|7z|gz|tar)$`)
    and re.regex($e.target.file.full_path, `(?i)(Downloads|Temp|AppData)`)
    and re.regex($e.principal.process.file.full_path, `(?i)(outlook|thunderbird|chrome|msedge|firefox|iexplore)\.exe$`)

  condition:
    $e
}

rule t1027_015_sfx_exec_chain {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects self-extracting archive execution spawning cmd/powershell from download/temp paths — T1027.015"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1027.015"
    severity = "HIGH"
    priority = "HIGH"

  events:
    // First: EXE launched from user-accessible path by browser or explorer
    $launch.metadata.event_type = "PROCESS_LAUNCH"
    $launch.principal.hostname = $hostname
    re.regex($launch.principal.process.file.full_path, `(?i)(explorer|outlook|chrome|msedge|firefox)\.exe$`)
    re.regex($launch.target.process.file.full_path, `(?i)(Downloads|Temp|Desktop|AppData).*\.exe$`)
    $launch.target.process.pid = $parent_pid

    // Second: spawned shell process from same parent
    $shell.metadata.event_type = "PROCESS_LAUNCH"
    $shell.principal.hostname = $hostname
    $shell.principal.process.pid = $parent_pid
    re.regex($shell.target.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta)\.exe$`)

  match:
    $hostname over 2m

  condition:
    $launch and $shell
}