Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for T1027.015.
Upgrade to ProDetect Compression in Microsoft Sentinel
This detection identifies adversary use of file compression utilities (ZIP, gzip, 7z, RAR, tar) to obfuscate payloads, stage data for exfiltration, or deliver malicious archives. Key signals include compression tools spawned by unusual parent processes, self-extracting archive execution, concatenated ZIP files used to evade scanners, and shellcode compressed into registry keys. The detection focuses on behavioral anomalies such as compression utilities invoked from scripting engines, email clients, or Office applications, as well as archives extracted directly into temporary or startup directories.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.015 Compression
- Canonical reference
- https://attack.mitre.org/techniques/T1027/015/
KQL Detection Query
let compressionTools = dynamic(["7z.exe", "7za.exe", "7zr.exe", "winzip32.exe", "winzip64.exe", "winrar.exe", "rar.exe", "unrar.exe", "wzzip.exe", "pkzip.exe", "compress.exe"]);
let suspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe", "msiexec.exe"]);
let suspiciousDirs = dynamic(["\\Temp\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\", "\\Users\\Public\\"]);
union DeviceProcessEvents
| where TimeGenerated >= ago(24h)
| where FileName in~ (compressionTools)
or (FileName =~ "tar.exe" and ProcessCommandLine has_any ("-z", "-j", "-J", "--gzip", "--bzip2"))
| extend ParentLower = tolower(InitiatingProcessFileName)
| where ParentLower in~ (suspiciousParents)
or ProcessCommandLine has_any ("sfx", "-sfx", "self-extract", "-ao", "-p", "-mhe", "-mx9")
or (ProcessCommandLine has_any (suspiciousDirs))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256, ReportId
| order by TimeGenerated descDetects compression utility execution (7z, WinRAR, WinZip, etc.) spawned by suspicious parent processes such as Office apps, scripting engines, or shells, or invoked with flags associated with self-extracting archives and encrypted payloads. Also flags compression into high-risk directories commonly used for staging.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT automation scripts that use 7z or WinRAR for backup or patch packaging via cmd.exe or PowerShell
- Developers compressing build artifacts from Office-launched terminal sessions or IDEs
- Security tools performing automated archive scans that spawn compression utilities
Other platforms for T1027.015
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 17zip Self-Extracting Archive Creation from PowerShell
Expected signal: Sysmon Event ID 1: PowerShell spawning 7z.exe with -sfx, -p, -mhe flags. Sysmon Event ID 11: payload.exe created in C:\Users\Public\. DeviceProcessEvents in MDE.
- Test 2Concatenated ZIP Payload Creation
Expected signal: Sysmon Event ID 1: cmd.exe spawning 7z.exe twice. Sysmon Event ID 11: concatenated.zip created in C:\Temp\. Security Event 4688 if process auditing enabled.
- Test 3Linux gzip Compression of Shellcode Blob
Expected signal: Auditd syscall logs showing dd, gzip, and base64 invocations. Syslog entries for process execution. File creation event for /tmp/.hidden_payload.b64.
References (5)
- https://attack.mitre.org/techniques/T1027/015/
- https://perception-point.io/blog/analysis-of-a-phishing-campaign-using-concatenated-zip-files/
- https://www.ntt-review.jp/archive/ntttechnical.php?contents=ntr202203fa1.html
- https://thehackernews.com/2024/02/hackers-exploit-self-extracting-archive.html
- https://www.prevailion.com/darkwatchman-new-fileless-techniques/
Unlock playbooks & atomic tests with Pro
Get the full detection package for T1027.015 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month