| elastic |
GenAI Process Performing Encoding/Chunking Prior to Network Activity |
production |
2026-09-25 |
| splunk |
Detect Renamed WinRAR |
deprecated |
2026-09-23 |
| splunk |
Detect Renamed 7-Zip |
deprecated |
2026-09-23 |
| elastic |
Sensitive Files Compression Inside A Container |
production |
2026-09-18 |
| elastic |
Encrypting Files with WinRar or 7z |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression |
production |
2026-09-18 |
| elastic |
Sensitive File Compression Detected via Defend for Containers |
production |
2026-09-18 |
| sigma |
Password Protected Compressed File Extraction Via 7Zip |
test |
2026-06-05 |
| sigma |
7Zip Compressing Dump Files |
test |
2026-06-05 |
| sigma |
Compress Data and Lock With Password for Exfiltration With 7-ZIP |
test |
2026-06-05 |
| splunk |
Windows Archive Collected Data via Rar |
production |
2026-05-13 |
| splunk |
IcedID Exfiltrated Archived File Creation |
production |
2026-05-13 |
| splunk |
Anomalous usage of 7zip |
production |
2026-05-13 |
| splunk |
7zip CommandLine To SMB Share Path |
production |
2026-05-13 |
| sigma |
LiteLLM / TeamPCP Supply Chain Attack Indicators |
experimental |
2026-03-30 |
| sigma |
WinRAR Execution in Non-Standard Folder |
test |
2025-07-16 |
| sigma |
Disk Image Mounting Via Hdiutil - MacOS |
test |
2024-08-10 |
| sigma |
Compressed File Extraction Via Tar.EXE |
test |
2023-12-19 |
| sigma |
Compressed File Creation Via Tar.EXE |
test |
2023-12-19 |
| sigma |
Winrar Compressing Dump Files |
test |
2023-09-12 |
| sigma |
Potentially Suspicious Compression Tool Parameters |
test |
2023-08-29 |
| sigma |
Data Compressed |
test |
2023-07-28 |
| sigma |
APT31 Judgement Panda Activity |
test |
2023-03-10 |
| sigma |
Suspicious Manipulation Of Default Accounts Via Net.EXE |
test |
2023-02-21 |
| sigma |
Files Added To An Archive Using Rar.EXE |
test |
2023-02-05 |
| sigma |
Cisco Stage Data |
test |
2023-01-04 |
| sigma |
Compress Data and Lock With Password for Exfiltration With WINZIP |
test |
2022-12-25 |
| sigma |
Rar Usage with Password and Compression Level |
test |
2022-03-16 |