Password Protected ZIP File Opened (Suspicious Filenames)

Title: Password Protected ZIP File Opened (Suspicious Filenames)
Status: test
Description:Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
References:
  -https://twitter.com/sbousseaden/status/1523383197513379841
Author: Florian Roth (Nextron Systems)
Date: 2022-05-09
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.stealth'
• -'attack.t1027'
• -'attack.t1105'
• -'attack.t1036'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '5379'
    TargetName|contains: 'Microsoft_Windows_Shell_ZipFolder:filename'
  selection_filename:
    TargetName|contains:
      -'invoice'
      -'new order'
      -'rechnung'
      -'factura'
      -'delivery'
      -'purchase'
      -'order'
      -'payment'

  condition:selection and selection_filename
Falsepositives:
  -Legitimate used of encrypted ZIP files
Level: high