Skip to content

Instantly share code, notes, and snippets.

@Samirbous

Samirbous/EQL - Exec pwd protected zip

Created May 8, 2022 19:36
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Samirbous/b5653c40b8fc463f3a4c4859029393d4 to your computer and use it in GitHub Desktop.
Save Samirbous/b5653c40b8fc463f3a4c4859029393d4 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
EQL - Exec pwd protected zip
sequence by host.id with maxspan=1m
[any where event.code : "5379" and winlog.event_data.TargetName : "Microsoft_Windows_Shell_ZipFolder*"]
[process where event.action == "start" and process.executable : "?:\\Users\\*\\Appdata\\Local\\Temp\\Temp?_*" and process.parent.name : "explorer.exe"]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment