Suspicious ZipExec Execution

Title: Suspicious ZipExec Execution
Status: test
Description:ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
References:
  -https://twitter.com/SBousseaden/status/1451237393017839616
  -https://github.com/Tylous/ZipExec
Author: frack113
Date: 2021-11-07
modified:2022-12-25
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1202'

Logsource:

• category: process_creation
• product: windows

Detection:
  run:
    CommandLine|contains|all:
      -'/generic:Microsoft_Windows_Shell_ZipFolder:filename='
      -'.zip'
      -'/pass:'
      -'/user:'

  delete:
    CommandLine|contains|all:
      -'/delete'
      -'Microsoft_Windows_Shell_ZipFolder:filename='
      -'.zip'

  condition:run or delete
Falsepositives:
  -Unknown
Level: medium