Archive Collected Data

let ArchiveUtilities = dynamic(["7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe"]);
let SuspiciousParents = dynamic(["winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "mshta.exe", "wscript.exe", "cscript.exe", "mmc.exe", "regsvr32.exe", "rundll32.exe"]);
// Detection 1: Password-protected archives — strongest indicator of pre-exfiltration data staging
let PasswordProtectedArchive = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (ArchiveUtilities)
| where ProcessCommandLine has "-hp"
      or ProcessCommandLine has_any ("-pass", "-password")
      or ProcessCommandLine matches regex @"\s+-p\S"
| extend DetectionType = "Password-Protected Archive", RiskLevel = "High";
// Detection 2: Archive utilities spawned by Office apps or scripting engines (macro/script-based staging)
let SuspiciousParentArchive = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (ArchiveUtilities)
| where InitiatingProcessFileName in~ (SuspiciousParents)
| extend DetectionType = "Archive via Suspicious Parent Process", RiskLevel = "High";
// Detection 3: PowerShell compression using .NET classes (custom staging or library-based archiving)
let PSCompression = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("Compress-Archive", "IO.Compression.ZipFile", "IO.Compression.GZipStream", "System.IO.Compression", "ZipArchive", "DeflateStream", "GZipStream")
| extend DetectionType = "PowerShell .NET Compression", RiskLevel = "Medium";
// Detection 4: certutil base64 encoding — encodes binary blobs for text-channel or clipboard exfiltration
let CertutilEncoding = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any ("-encode", "-decode", "-encodehex")
| extend DetectionType = "CertUtil Base64 Encoding", RiskLevel = "Medium";
// Combine all detections
union PasswordProtectedArchive, SuspiciousParentArchive, PSCompression, CertutilEncoding
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DetectionType, RiskLevel
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\7z.exe" OR Image="*\\7za.exe" OR Image="*\\7zr.exe" OR Image="*\\rar.exe" OR Image="*\\winrar.exe"
   OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe")
| eval CommandLineLower=lower(CommandLine)
| eval IsArchiveTool=if(match(Image, "(?i)(7z[ar]?\.exe|rar\.exe|winrar\.exe)$"), 1, 0)
| eval PasswordProtected=if(IsArchiveTool=1 AND (match(CommandLineLower, "\s-hp") OR match(CommandLineLower, "-pass") OR match(CommandLineLower, "\s-p\S")), 1, 0)
| eval SuspiciousParent=if(IsArchiveTool=1 AND match(lower(ParentImage), "(?i)(winword|excel|outlook|powerpnt|mshta|wscript|cscript|mmc|regsvr32|rundll32)\.exe$"), 1, 0)
| eval PSCompression=if(match(Image, "(?i)(powershell|pwsh)\.exe$") AND match(CommandLineLower, "(compress-archive|io\.compression|zipfile|gzipstream|deflatestream|ziparchive)"), 1, 0)
| eval CertutilEncode=if(match(Image, "(?i)certutil\.exe$") AND match(CommandLineLower, "(-encode|-decode|-encodehex)"), 1, 0)
| eval SuspicionScore=PasswordProtected + SuspiciousParent + PSCompression + CertutilEncode
| where SuspicionScore > 0
| eval DetectionType=case(
    PasswordProtected=1, "Password-Protected Archive",
    SuspiciousParent=1, "Archive via Suspicious Parent",
    PSCompression=1, "PowerShell .NET Compression",
    CertutilEncode=1, "CertUtil Encoding",
    true(), "Archive Activity")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionType, SuspicionScore
| sort - _time

process where event.type == "start" and
(
  (
    process.name : ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe") and
    process.command_line : ("* -hp*", "* -pass*", "* -password*", "* -p?*")
  ) or
  (
    process.name : ("7z.exe", "7za.exe", "7zr.exe", "rar.exe", "winrar.exe") and
    process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe",
                            "mshta.exe", "wscript.exe", "cscript.exe",
                            "mmc.exe", "regsvr32.exe", "rundll32.exe")
  ) or
  (
    process.name : ("powershell.exe", "pwsh.exe") and
    process.command_line : ("*Compress-Archive*", "*IO.Compression.ZipFile*",
                            "*IO.Compression.GZipStream*", "*System.IO.Compression*",
                            "*ZipArchive*", "*DeflateStream*", "*GZipStream*")
  ) or
  (
    process.name : "certutil.exe" and
    process.command_line : ("*-encode*", "*-decode*", "*-encodehex*")
  )
)

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  LOGSOURCENAME(logsourceid) AS log_source,
  username,
  "Process Name" AS process_name,
  "Process Command Line" AS command_line,
  "Parent Process Name" AS parent_process,
  CASE
    WHEN LOWER("Process Name") LIKE ANY ('%\\7z.exe', '%\\7za.exe', '%\\7zr.exe', '%\\rar.exe', '%\\winrar.exe')
         AND (LOWER("Process Command Line") LIKE '% -hp%'
              OR LOWER("Process Command Line") LIKE '%-pass%'
              OR LOWER("Process Command Line") LIKE '%-password%')
      THEN 'Password-Protected Archive'
    WHEN LOWER("Process Name") LIKE ANY ('%\\7z.exe', '%\\7za.exe', '%\\7zr.exe', '%\\rar.exe', '%\\winrar.exe')
         AND LOWER("Parent Process Name") LIKE ANY ('%\\winword.exe', '%\\excel.exe', '%\\outlook.exe',
              '%\\powerpnt.exe', '%\\mshta.exe', '%\\wscript.exe', '%\\cscript.exe',
              '%\\mmc.exe', '%\\regsvr32.exe', '%\\rundll32.exe')
      THEN 'Archive via Suspicious Parent'
    WHEN LOWER("Process Name") LIKE ANY ('%\\powershell.exe', '%\\pwsh.exe')
         AND (LOWER("Process Command Line") LIKE '%compress-archive%'
              OR LOWER("Process Command Line") LIKE '%io.compression%'
              OR LOWER("Process Command Line") LIKE '%gzipstream%'
              OR LOWER("Process Command Line") LIKE '%deflatestream%'
              OR LOWER("Process Command Line") LIKE '%ziparchive%')
      THEN 'PowerShell .NET Compression'
    WHEN LOWER("Process Name") LIKE '%\\certutil.exe'
         AND (LOWER("Process Command Line") LIKE '%-encode%'
              OR LOWER("Process Command Line") LIKE '%-encodehex%')
      THEN 'CertUtil Encoding'
    ELSE 'Suspicious Archive Activity'
  END AS detection_type
FROM events
WHERE
  devicetime > NOW() - 86400000
  AND (
    (
      LOWER("Process Name") LIKE ANY ('%\\7z.exe', '%\\7za.exe', '%\\7zr.exe', '%\\rar.exe', '%\\winrar.exe')
      AND (
        LOWER("Process Command Line") LIKE '% -hp%'
        OR LOWER("Process Command Line") LIKE '%-pass%'
        OR LOWER("Process Command Line") LIKE '%-password%'
        OR LOWER("Parent Process Name") LIKE ANY (
          '%\\winword.exe', '%\\excel.exe', '%\\outlook.exe', '%\\powerpnt.exe',
          '%\\mshta.exe', '%\\wscript.exe', '%\\cscript.exe',
          '%\\mmc.exe', '%\\regsvr32.exe', '%\\rundll32.exe'
        )
      )
    )
    OR (
      LOWER("Process Name") LIKE ANY ('%\\powershell.exe', '%\\pwsh.exe')
      AND (
        LOWER("Process Command Line") LIKE '%compress-archive%'
        OR LOWER("Process Command Line") LIKE '%io.compression%'
        OR LOWER("Process Command Line") LIKE '%gzipstream%'
        OR LOWER("Process Command Line") LIKE '%deflatestream%'
        OR LOWER("Process Command Line") LIKE '%ziparchive%'
      )
    )
    OR (
      LOWER("Process Name") LIKE '%\\certutil.exe'
      AND (
        LOWER("Process Command Line") LIKE '%-encode%'
        OR LOWER("Process Command Line") LIKE '%-encodehex%'
      )
    )
  )
ORDER BY devicetime DESC

_sourceCategory=*windows/sysmon* OR _sourceCategory=*sysmon*
| where EventCode="1"
| eval image_lc=toLowerCase(Image)
| eval cmdline_lc=toLowerCase(CommandLine)
| eval parent_lc=toLowerCase(ParentImage)
| where (image_lc matches "*\\7z.exe" OR image_lc matches "*\\7za.exe" OR image_lc matches "*\\7zr.exe"
         OR image_lc matches "*\\rar.exe" OR image_lc matches "*\\winrar.exe"
         OR image_lc matches "*\\powershell.exe" OR image_lc matches "*\\pwsh.exe"
         OR image_lc matches "*\\certutil.exe")
| eval is_archive=if(image_lc matches "*\\7z.exe" OR image_lc matches "*\\7za.exe" OR image_lc matches "*\\7zr.exe"
         OR image_lc matches "*\\rar.exe" OR image_lc matches "*\\winrar.exe", 1, 0)
| eval password_protected=if(is_archive=1 AND (cmdline_lc contains " -hp" OR cmdline_lc contains "-pass" OR cmdline_lc contains "-password"), 1, 0)
| eval suspicious_parent=if(is_archive=1 AND (parent_lc matches "*\\winword.exe" OR parent_lc matches "*\\excel.exe"
         OR parent_lc matches "*\\outlook.exe" OR parent_lc matches "*\\powerpnt.exe"
         OR parent_lc matches "*\\mshta.exe" OR parent_lc matches "*\\wscript.exe"
         OR parent_lc matches "*\\cscript.exe" OR parent_lc matches "*\\mmc.exe"
         OR parent_lc matches "*\\regsvr32.exe" OR parent_lc matches "*\\rundll32.exe"), 1, 0)
| eval ps_compression=if((image_lc matches "*\\powershell.exe" OR image_lc matches "*\\pwsh.exe")
         AND (cmdline_lc contains "compress-archive" OR cmdline_lc contains "io.compression"
              OR cmdline_lc contains "gzipstream" OR cmdline_lc contains "deflatestream"
              OR cmdline_lc contains "ziparchive"), 1, 0)
| eval certutil_encode=if(image_lc matches "*\\certutil.exe"
         AND (cmdline_lc contains "-encode" OR cmdline_lc contains "-encodehex"), 1, 0)
| where password_protected=1 OR suspicious_parent=1 OR ps_compression=1 OR certutil_encode=1
| eval DetectionType=if(password_protected=1, "Password-Protected Archive",
    if(suspicious_parent=1, "Archive via Suspicious Parent",
    if(ps_compression=1, "PowerShell .NET Compression",
    if(certutil_encode=1, "CertUtil Encoding", "Suspicious Archive Activity"))))
| fields _time, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, DetectionType
| sort by _time desc

rule t1560_archive_collected_data {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1560 Archive Collected Data - password-protected archive creation, Office/script spawned archivers, PowerShell .NET compression, and CertUtil encoding used as pre-exfiltration data staging"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1560"
    mitre_attack_subtechniques = "T1560.001, T1560.002, T1560.003"
    severity = "HIGH"
    risk_score = "75"
    reference = "https://attack.mitre.org/techniques/T1560/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.target.process.file.full_path, `(?i)(7z[ar]?\.exe|rar\.exe|winrar\.exe)$`) and
        (
          re.regex($e.target.process.command_line, `(?i)\s-hp`) or
          strings.contains(strings.to_lower($e.target.process.command_line), "-pass") or
          strings.contains(strings.to_lower($e.target.process.command_line), "-password")
        )
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(7z[ar]?\.exe|rar\.exe|winrar\.exe)$`) and
        re.regex($e.principal.process.file.full_path, `(?i)(winword|excel|outlook|powerpnt|mshta|wscript|cscript|mmc|regsvr32|rundll32)\.exe$`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        (
          strings.contains(strings.to_lower($e.target.process.command_line), "compress-archive") or
          strings.contains(strings.to_lower($e.target.process.command_line), "io.compression") or
          strings.contains(strings.to_lower($e.target.process.command_line), "gzipstream") or
          strings.contains(strings.to_lower($e.target.process.command_line), "deflatestream") or
          strings.contains(strings.to_lower($e.target.process.command_line), "ziparchive")
        )
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)certutil\.exe$`) and
        (
          strings.contains(strings.to_lower($e.target.process.command_line), "-encode") or
          strings.contains(strings.to_lower($e.target.process.command_line), "-encodehex")
        )
      )
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| FileName = /(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe|powershell\.exe|pwsh\.exe|certutil\.exe)/i
| IsArchiveTool := FileName = /(7z\.exe|7za\.exe|7zr\.exe|rar\.exe|winrar\.exe)/i
| PasswordProtected := IsArchiveTool = true AND CommandLine = /(\s-hp|-pass(word)?|\s-p\S)/i
| SuspiciousParent := IsArchiveTool = true AND ParentBaseFileName = /(winword|excel|outlook|powerpnt|mshta|wscript|cscript|mmc|regsvr32|rundll32)\.exe/i
| PSCompression := FileName = /(powershell|pwsh)\.exe/i AND CommandLine = /(Compress-Archive|IO\.Compression|GZipStream|DeflateStream|ZipArchive)/i
| CertutilEncode := FileName = /certutil\.exe/i AND CommandLine = /(-encode|-decode|-encodehex)/i
| PasswordProtected = true OR SuspiciousParent = true OR PSCompression = true OR CertutilEncode = true
| DetectionType := case {
    PasswordProtected = true => "Password-Protected Archive";
    SuspiciousParent = true => "Archive via Suspicious Parent";
    PSCompression = true => "PowerShell .NET Compression";
    CertutilEncode = true => "CertUtil Encoding";
    * => "Suspicious Archive Activity"
  }
| select([timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, DetectionType])
| sort(timestamp, order=desc)