Execution from a Password Protected Self Extracting Archive

[rule]
description = """
Identifies the execution of a file from a password protected self-extracting archive. Adversaries may encapsulate
malicious code in a protected archive to potentially bypass security controls.
"""
id = "559bb183-f343-4ad6-926f-144db38018d6"
license = "Elastic License v2"
name = "Execution from a Password Protected Self Extracting Archive"
os_list = ["windows"]
reference = [
    "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/archive-sidestepping-self-unlocking-password-protected-rar/",
]
version = "1.0.22"

query = '''
sequence with maxspan=1m
  [file where event.action : "creation" and file.name : "*_sfx_access_check*"] by process.entity_id
  [process where event.action : "start" and
   process.parent.args : "-p*" and process.parent.args : "-d*"] by process.parent.entity_id
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[threat.technique.subtechnique]]
id = "T1204.002"
name = "Malicious File"
reference = "https://attack.mitre.org/techniques/T1204/002/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"