Cross-source coverage
T1027.015 / ATT&CK
Obfuscated Files or Information: Compression
2 rules across 1 source.
From MITRE ATT&CK 19.2
Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., Fileless Storage).
In order to further evade detection, adversaries may combine multiple ZIP files into one archive. This process of concatenation creates an archive that appears to be a single archive but in fact contains the central directories of the embedded archives. Some ZIP readers, such as 7zip, may not be able to identify concatenated ZIP files and miss the presence of the malicious payload.
File archives may be sent as one Spearphishing Attachment through email. Adversaries have sent malicious payloads as archived files to encourage the user to interact with and extract the malicious payload onto their system (i.e., Malicious File). However, some file compression tools, such as 7zip, can be used to produce self-extracting archives. Adversaries may send self-extracting archives to hide the functionality of their payload and launch it without requiring multiple actions from the user.
Compression may be used in combination with Encrypted/Encoded File where compressed files are encrypted and password-protected.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogfs:fsusage
How MITRE says to detect it DET0281
Detection Strategy for Compressed Payload Creation and Execution
Windows Analytic 0782
Monitors for compression tool usage (e.g., 7zip, WinRAR, MakeCab) that follows or precedes file modification, suspicious file types (e.g.,.exe,.dll) being compressed, or dropped from self-extracting archives followed by immediate execution.
WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11
Linux Analytic 0783
Detects sequential command-line compression utilities (e.g., gzip, tar, zip, 7z) followed by execution of unpacked files, especially in temp directories or under non-standard locations like /dev/shm or /tmp with ELF binaries.
auditd:SYSCALLexecveauditd:SYSCALLwriteauditd:SYSCALLopenatauditd:SYSCALLchmod
macOS Analytic 0784
Identifies archive utilities (e.g., ditto, unzip, xar, pkgutil) used to extract payloads to non-standard paths, then correlates with execution or file permission changes (e.g., `chmod +x`) and process spawns from decompressed location.
macos:unifiedlogProcess launchmacos:unifiedlogfilesystem eventsfs:fsusagefile open/write
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| PowerShell Suspicious Payload Encoded and Compressed | High | Elastic TOML |
| Suspicious Content Extracted or Decompressed via Funzip | Medium | Elastic TOML |