collection_winrar_encryption.toml

[metadata]
creation_date = "2020/12/04"
maturity = "production"
updated_date = "2021/09/23"

[rule]
author = ["Elastic"]
description = """
Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in
preparation for exfiltration.
"""
from = "now-9m"
index = ["logs-endpoint.events.*", "winlogbeat-*", "logs-windows.*"]
language = "eql"
license = "Elastic License v2"
name = "Encrypting Files with WinRar or 7z"
references = ["https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"]
risk_score = 47
rule_id = "45d273fb-1dca-457d-9855-bcb302180c21"
severity = "medium"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Collection"]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where event.type in ("start", "process_started") and
  ((process.name:"rar.exe" or process.code_signature.subject_name == "win.rar GmbH" or
      process.pe.original_file_name == "Command line RAR") and
    process.args == "a" and process.args : ("-hp*", "-p*", "-dw", "-tb", "-ta", "/hp*", "/p*", "/dw", "/tb", "/ta"))

  or
  (process.pe.original_file_name in ("7z.exe", "7za.exe") and
     process.args == "a" and process.args : ("-p*", "-sdel"))

  /* uncomment if noisy for backup software related FPs */
  /* not process.parent.executable : ("C:\\Program Files\\*.exe", "C:\\Program Files (x86)\\*.exe") */
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1560"
name = "Archive Collected Data"
reference = "https://attack.mitre.org/techniques/T1560/"

  [[rule.threat.technique.subtechnique]]
  id = "T1560.001"
  name = "Archive via Utility"
  reference = "https://attack.mitre.org/techniques/T1560/001/"


[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"