Detect Archive Collected Data in Google Chronicle

rule t1560_archive_collected_data {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1560 Archive Collected Data - password-protected archive creation, Office/script spawned archivers, PowerShell .NET compression, and CertUtil encoding used as pre-exfiltration data staging"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1560"
    mitre_attack_subtechniques = "T1560.001, T1560.002, T1560.003"
    severity = "HIGH"
    risk_score = "75"
    reference = "https://attack.mitre.org/techniques/T1560/"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.target.process.file.full_path, `(?i)(7z[ar]?\.exe|rar\.exe|winrar\.exe)$`) and
        (
          re.regex($e.target.process.command_line, `(?i)\s-hp`) or
          strings.contains(strings.to_lower($e.target.process.command_line), "-pass") or
          strings.contains(strings.to_lower($e.target.process.command_line), "-password")
        )
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(7z[ar]?\.exe|rar\.exe|winrar\.exe)$`) and
        re.regex($e.principal.process.file.full_path, `(?i)(winword|excel|outlook|powerpnt|mshta|wscript|cscript|mmc|regsvr32|rundll32)\.exe$`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        (
          strings.contains(strings.to_lower($e.target.process.command_line), "compress-archive") or
          strings.contains(strings.to_lower($e.target.process.command_line), "io.compression") or
          strings.contains(strings.to_lower($e.target.process.command_line), "gzipstream") or
          strings.contains(strings.to_lower($e.target.process.command_line), "deflatestream") or
          strings.contains(strings.to_lower($e.target.process.command_line), "ziparchive")
        )
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)certutil\.exe$`) and
        (
          strings.contains(strings.to_lower($e.target.process.command_line), "-encode") or
          strings.contains(strings.to_lower($e.target.process.command_line), "-encodehex")
        )
      )
    )

  condition:
    $e
}