Command Line Usage of Archiving Software

Hypothesis and description

Before exfiltrating data that an adversary has collected, it is very likely that a compressed archive will be created, so that transfer times are minimized and fewer files are transmitted. There is variety between the tools used to compress data, but the command line usage and context of archiving tools, such as ZIP, RAR, and 7ZIP, should be monitored.

In addition to looking for RAR or 7z program names, command line usage of 7Zip or RAR can be detected with the flag usage of "\* a \*". This is helpful, as adversaries may change program names.

Platforms: Windows, Linux, macOS
Domain: Host
Subtypes: Process
Submitted: 2013-07-31
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1560 Archive Collected DataT1560.001	Exfiltration	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1560Archive Collected Data
.001 Archive via Utility

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

process/create/command_line

Pseudocode and implementations

Pseudocode

This analytic looks for the command line argument a, which is used by RAR. However, there may be other programs that have this as a legitimate argument and may need to be filtered out.

processes = search Process:Create
rar_argument = filter processes where (command_line == "* a *")
output rar_argument

DNIFData model: Sysmon native

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $Process=regex(.* a .*)i limit 100

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 command="* a *"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

View CAR-2013-07-005 on car.mitre.org

Hypothesis and description

In addition to looking for RAR or 7z program names, command line usage of 7Zip or RAR can be detected with the flag usage of "\* a \*". This is helpful, as adversaries may change program names.

Technique

Tactics

Coverage

T1560 Archive Collected DataT1560.001

Exfiltration

Moderate